Skip to main content

Http Server CVE-2024-42516

| EUVDEUVD-2024-54775 HIGH
Improper Input Validation (CWE-20)
2025-07-10 security@apache.org
Apache Information Disclosure Red Hat Http Server Suse Apache HTTP Server
7.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Impact

CVSS 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N indicates network-accessible, easy-to-exploit vulnerability requiring no privileges or user interaction. However, the integrity impact (I:H) without confidentiality or availability impact suggests XSS/cache poisoning rather than server compromise. The fact that this requires manipulating Content-Type headers of 'applications hosted or proxied by the server' introduces a dependency on application behavior—an attacker must either control a proxied backend response or a hosted application's output. Real-world exploitation probability is significant: (1) KEV status unknown but patch-evasion history (2.4.59 incomplete fix) suggests active research/exploitation; (2) Attack vector is network with low complexity; (3) SSVC factors: exploitation is probable given patch history, automation potential is high (header injection is formulaic), technical impact is integrity-compromised. This is NOT a false-positive high-CVSS scenario—it's a legitimate network-accessible integrity attack with moderate environmental dependency. Priority: HIGH for internet-facing Apache deployments, CRITICAL for those proxying untrusted backends.
Exploit ScenarioDerived

An attacker identifies an Apache HTTP Server proxying a backend application with reflected Content-Type headers (e.g., ?type=application/json echoed in response). The attacker crafts a request: GET /?type=text/html%0D%0ASet-Cookie:sessionid=attacker HTTP/1.1, causing the proxied response to include the injected Set-Cookie header, hijacking sessions. Alternatively, if the application reflects user input into Content-Type, the attacker injects JavaScript via a second response body: GET /?type=text/html%0D%0A%0D%0A<script>alert('xss')</script> HTTP/1.1, achieving stored XSS in cached responses. Attack complexity is low (simple URL encoding), requiring only network access and knowledge of a reflective endpoint—no authentication or user interaction needed. The patch evasion history (CVE-2023-38709 → incomplete 2.4.59 fix → CVE-2024-42516) suggests this technique is known to red teams and likely already in active proof-of-concept form.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

HTTP response splitting vulnerability in Apache HTTP Server core allows network-based attackers without authentication to inject arbitrary HTTP headers and content into responses by manipulating Content-Type headers in proxied or hosted applications, potentially enabling cache poisoning, session hijacking, or XSS attacks. Affects Apache HTTP Server versions prior to 2.4.64, with a critical note that the initial patch in 2.4.59 was incomplete. This is a regression/incomplete fix of CVE-2023-38709, indicating patch evasion and suggesting active exploitation interest.

RemediationAI

patch: Upgrade to Apache HTTP Server version 2.4.64 or later immediately; details: This version includes the complete fix for HTTP response splitting in Content-Type header handling interim_mitigation: Implement mod_security or similar WAF rules to sanitize responses; details: Filter or block responses containing suspicious CRLF sequences in headers; monitor for header injection patterns interim_mitigation: Restrict proxied backend applications; details: Limit proxying to trusted internal services; sanitize all backend responses at the application layer if possible interim_mitigation: Implement response header validation; details: Use Apache directives to strip or rewrite potentially dangerous Content-Type header values if patch cannot be deployed immediately configuration: Review and harden Content-Type header policies; details: Ensure applications set explicit, safe Content-Type values and do not echo user input into response headers

Affected VersionsENISA

Apache HTTP Server 2.4.0 ≤2.4.63

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

HTTP response splitting (CWE-20: Improper Input Validation) occurs when attacker-controlled data is insufficiently sanitized before being included in HTTP response headers. In this case, the vulnerability exists in Apache HTTP Server's core handling of Content-Type response headers. The server fails to properly validate or sanitize header values, allowing an attacker to inject CRLF (carriage return/line feed) sequences into the Content-Type header, which terminates the header section and allows injection of arbitrary additional headers or response body content. This affects the HTTP/1.1 protocol implementation (CVE-2023-38709 correlation indicates a long-standing issue). The incomplete patch in version 2.4.59 demonstrates that input validation filtering was insufficient, requiring more comprehensive header sanitization in 2.4.64. Affected CPE likely includes cpe:2.3:a:apache:http_server:2.4.0:through:2.4.63:*:*:*:*:*:*

Know when Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Ubuntu MEDIUM
SUSE HIGH
Red Hat 6.8 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jul 10, 2025 - 17:15 nvd
HIGH 7.5

DescriptionCVE.org

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.

Executive ViewAI

Why It Matters

Apache HTTP Server versions 2.4.59 through 2.4.63 contain an HTTP response splitting vulnerability that allows attackers to manipulate response headers and inject malicious content into HTTP responses. This affects any organization running vulnerable Apache versions that host or proxy web applications, potentially enabling session hijacking, cache poisoning, and credential theft.

Business Impact: High
Compensating Controls

Until patching is completed, implement WAF rules to inspect and block HTTP responses containing suspicious header manipulation patterns; restrict Content-Type header modifications at the application level; segment proxied applications from internet-facing infrastructure where possible; implement strict input validation for any user-controlled data affecting response headers; monitor HTTP response logs for anomalous header patterns indicating exploitation attempts.

Threat Intelligence Overview

EPSS Score
0.3%
Top 46% exploitable
Exploit
POC
Public exploit code exists
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Http Server

View all
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2017-9798 HIGH POC
7.5 Sep 18

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

CVE-2014-0226 MEDIUM POC
6.8 Jul 20

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
CVE-2016-8740 HIGH POC
7.5 Dec 05

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
CVE-2026-21962 CRITICAL POC
10.0 Jan 20

Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
CVE-2020-1967 HIGH POC
7.5 Apr 21

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
CVE-2013-5704 MEDIUM POC
5.0 Apr 15

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
CVE-2013-2249 HIGH POC
7.5 Jul 23

mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
CVE-2016-5387 HIGH
8.1 Jul 19

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
CVE-2017-7668 HIGH
7.5 Jun 20

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Ubuntu

Priority: Medium
apache2
Release Status Version
trusty needs-triage -
upstream released 2.4.64-1
jammy released 2.4.52-1ubuntu4.15
noble released 2.4.58-1ubuntu8.7
plucky released 2.4.63-1ubuntu1.1
bionic released 2.4.29-1ubuntu4.27+esm6
focal released 2.4.41-4ubuntu3.23+esm2
xenial released 2.4.18-2ubuntu3.17+esm16
questing released 2.4.64-1ubuntu2
USN-7639-1 USN-7639-2

Debian

apache2
Release Status Fixed Version Urgency
bullseye fixed 2.4.65-1~deb11u1 -
bullseye (security) fixed 2.4.66-1~deb11u1 -
bookworm fixed 2.4.65-1~deb12u1 -
bookworm (security) vulnerable 2.4.62-1~deb12u2 -
trixie fixed 2.4.66-1~deb13u2 -
forky, sid fixed 2.4.66-8 -
(unstable) fixed 2.4.64-1 -
DLA-4270-1

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.10 Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.1.7.26.2 Container suse/manager/5.0/x86_64/server:5.0.5.1.7.33.2 Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.1.8.9.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.8.7.1 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Image proxy-httpd-image Image server-image Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6 Fixed

References

Advisories & patches
ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-42516 ADVISORY https://security-tracker.debian.org/tracker/dla-4270-1 ADVISORY https://ubuntu.com/security/notices/USN-7639-1 ADVISORY https://ubuntu.com/security/notices/USN-7639-2 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02565/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02682/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02683/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02684/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02685/ REF http://www.openwall.com/lists/oss-security/2025/07/10/2 REF http://www.openwall.com/lists/oss-security/2025/07/10/3 REF https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy