CVE-2023-38709: Apache HTTP Server: HTTP response splitting

Modified

AliasesALPINE-CVE-2023-38709RHSA-2024:4197UBUNTU-CVE-2023-38709+1 more

Published 04-04-2024Last modified 04-11-2025

Vulnerability summary

CVE-2023-38709 is a high (CVSS 7.3) vulnerability in apache software foundation apache http server. EPSS estimates a 3.91% chance of exploitation in the next 30 days, higher than 90.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.3 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 4% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.3/10

010

High · v3.1 (CVE.org)

EPSS score

3.91%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 14 · Related 9

DLA-3818-1 DSA-5662-1 MGASA-2024-0118 RHSA-2024:6927 RHSA-2024:9306 SUSE-SU-2024:1627-1+8 more

Timeline

04-04-2024
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.3

EPSS trend

Probability

3.91%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.91% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat22 products

httpd< 0:2.4.37-65.module+el8.10.0+21982+14717793
httpd-debuginfo< 0:2.4.37-65.module+el8.10.0+21982+14717793
httpd-debugsource< 0:2.4.37-65.module+el8.10.0+21982+14717793
httpd-devel< 0:2.4.37-65.module+el8.10.0+21982+14717793
httpd-filesystem< 0:2.4.37-65.module+el8.10.0+21982+14717793

Show all 22

Debian2 products

apache2< 2.4.59-1~deb12u1 | < 2.4.59-1
debian_linuxEOL10.0

Netapp2 products

ontap9
ontap_tools10

Alpine1 product

apache2< 2.4.59-r0

Apache1 product

http_server< 2.4.59

Apache software foundation1 product

apache http server≤ 2.4.58

Apple1 product

macos< 14.6

Broadcom1 product

fabric_operating_systemna

Fedoraproject1 product

fedoraEOL38 | 39 | 40

Ubuntu1 product

apache2< 2.4.7-1ubuntu4.22+esm12 | < 2.4.18-2ubuntu3.17+esm12 | < 2.4.29-1ubuntu4.27+esm2 | < 2.4.41-4ubuntu3.17 | < 2.4.52-1ubuntu4.9 | < 2.4.58-1ubuntu8.1

10 vendors · 33 products