CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

Analyzed

AliasesALPINE-CVE-2023-27522GHSA-vcph-37mh-fqrhBIT-apache-2023-27522+7 more

Published 07-03-2023Last modified 13-02-2025

Vulnerability summary

CVE-2023-27522 is a high (CVSS 7.5) vulnerability in apache software foundation apache http server. EPSS estimates a 2.13% chance of exploitation in the next 30 days, higher than 82% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

2.13%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 7

DLA-3401-1 DSA-5376-1 MGASA-2023-0100 OPENSUSE-SU-2024:12776-1 RHSA-2023:4629 SUSE-SU-2023:0764-1+5 more

Timeline

07-03-2023
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

2.13%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat26 products

httpd< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-core< 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-core-debuginfo< 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-debuginfo< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-debugsource< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9

httpd-devel< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-filesystem< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-manual< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-tools< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
httpd-tools-debuginfo< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
mod_http2< 0:1.15.7-5.module+el8.6.0+18506+34b194fb.2 | < 0:1.15.7-8.module+el8.8.0+18751+b4557bca.3
mod_http2-debuginfo< 0:1.15.7-5.module+el8.6.0+18506+34b194fb.2 | < 0:1.15.7-8.module+el8.8.0+18751+b4557bca.3
mod_http2-debugsource< 0:1.15.7-5.module+el8.6.0+18506+34b194fb.2 | < 0:1.15.7-8.module+el8.8.0+18751+b4557bca.3
mod_ldap< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
mod_ldap-debuginfo< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
mod_lua< 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
mod_lua-debuginfo< 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
mod_md< 1:2.0.8-8.module+el8.3.0+6814+67d1e611
mod_md-debuginfo< 1:2.0.8-8.module+el8.3.0+6814+67d1e611
mod_md-debugsource< 1:2.0.8-8.module+el8.3.0+6814+67d1e611
mod_proxy_html< 1:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 1:2.4.53-11.el9_2.6 | < 1:2.4.57-5.el9
mod_proxy_html-debuginfo< 1:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 1:2.4.53-11.el9_2.6 | < 1:2.4.57-5.el9
mod_session< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
mod_session-debuginfo< 0:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 0:2.4.53-11.el9_2.6 | < 0:2.4.57-5.el9
mod_ssl< 1:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 1:2.4.53-11.el9_2.6 | < 1:2.4.57-5.el9
mod_ssl-debuginfo< 1:2.4.37-47.module+el8.6.0+19809+6e655c60.7 | < 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 | < 1:2.4.53-11.el9_2.6 | < 1:2.4.57-5.el9

Show all 26

Debian2 products

apache2< 2.4.56-1
debian_linuxEOL10.0

Alpine1 product

apache2< 2.4.56-r0

Apache1 product

http_server≥ 2.4.30, < 2.4.56

Apache software foundation1 product

apache http server≥ 2.4.30, ≤ 2.4.55

PyPI1 product

uwsgi< 2.0.22

Ubuntu1 product

apache2< 2.4.41-4ubuntu3.14 | < 2.4.52-1ubuntu4.4

Unbit1 product

uwsgi< 2.0.22

8 vendors · 34 products

References

33 links

httpd.apache.org/security/vulnerabilities_24.htmlVendor AdvisoryWEBARTICLE
lists.debian.org/debian-lts-announce/2023/04/msg00028.htmlWEBThird Party Advisory
security.gentoo.org/glsa/202309-01WEBThird Party Advisory
security.alpinelinux.org/vuln/CVE-2023-27522Advisory
nvd.nist.gov/vuln/detail/CVE-2023-27522AdvisoryOval
github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2dWEB
github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822WEB
github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569WEB
github.com/unbit/uwsgiPACKAGE
uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.htmlWEB

Show all 33 references