Apache HTTP Server CVE-2026-63718

Exploitation requires Apache HTTP Server (2.4.30-2.4.68) deployed as a reverse proxy using the mod_proxy_uwsgi module to a uwsgi backend, AND the uwsgi backend must return a crafted response containing a Transfer-Encoding header that mod_proxy_uwsgi interprets inconsistently. The primary limiting factor is that the attacker must be able to control or influence the backend uwsgi response (e.g., via a compromised/malicious backend application or a response-header-injection flaw in the app) - this is not reachable against a default Apache install without mod_proxy_uwsgi configured. Deployments not using mod_proxy_uwsgi are not affected.

This is a CWE-444 HTTP response smuggling flaw in Apache HTTP Server's mod_proxy_uwsgi module, where a crafted uwsgi backend response containing a Transfer-Encoding header is inconsistently interpreted. Several key risk signals are MISSING from the input: no CVSS score or vector was provided (both N/A), no EPSS probability, no CISA KEV listing, and no POC reference - so quantitative exploitation-likelihood signals cannot be compared. Because no CVSS vector is supplied, authentication requirements cannot be confirmed from the data. Qualitatively, exploitation is gated by a significant precondition: the deployment must use Apache as a reverse proxy via mod_proxy_uwsgi, and the uwsgi backend must emit a crafted/attacker-influenced response - this is not a default-configuration, drive-by network attack, which materially lowers real-world risk relative to the ubiquity of the Apache product itself. The practical impact (response smuggling enabling cache poisoning, response queue desynchronization, and cross-client information disclosure) is meaningful where the vulnerable proxy configuration exists, but the narrow configuration and backend-control prerequisite suggest this is a moderate, configuration-dependent issue rather than a broadly wormable critical flaw. Treat as medium priority: patch promptly on hosts using mod_proxy_uwsgi, deprioritize elsewhere.

An organization runs Apache HTTP Server (2.4.30-2.4.68) as a reverse proxy fronting a Python/uwsgi application via mod_proxy_uwsgi. An attacker who can influence the uwsgi backend's response - for example through a header-injection flaw in the app or a malicious/compromised backend - causes it to return a response with a crafted Transfer-Encoding header that mod_proxy_uwsgi parses inconsistently, desynchronizing the response stream so a victim client receives a smuggled or another user's response, enabling cache poisoning and information disclosure. No public exploit identified at time of analysis.