CVE-2024-42516CWE-20

Apache HTTP Server: HTTP response splitting

High · published July 10, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00818 · 56.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-07-10T16:53Z
EPSS history
Timeline
  • 10 JUL 16:53Z
    Apache HTTP Server: HTTP response splitting
    cvelistv5