CVE-2024-24795: Apache HTTP Server: HTTP Response Splitting in multiple modules
Vulnerability summary
CVE-2024-24795 is a medium (CVSS 6.3) vulnerability in apache software foundation apache http server. EPSS estimates a 2.87% chance of exploitation in the next 30 days, higher than 86.8% of scored vulnerabilities.
Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 9Timeline
- 04-04-2024PublishedVulnerability first disclosed.
- 12-11-2024Last modifiedVulnerability information updated.
Description
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- NVDNIST6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS trend
Probability
2.87%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.87% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-113Improper Neutralization of CRLF Sequences in HTTP HeadersThe product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
- CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian3 products
- apache2< 2.4.59-1~deb12u1 | < 2.4.59-1
- uwsgiAll versions (No fix recorded)
- debian_linuxEOL10.0
Opensuse3 products
- uwsgi&distro=openSUSE Leap 15.5< 2.0.19.1-150400.8.3.1
- uwsgi&distro=openSUSE Leap 15.6< 2.0.19.1-150400.8.3.1
- uwsgi&distro=openSUSE Tumbleweed< 2.0.28-1.1
Netapp2 products
Suse2 products
- uwsgi&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 2.0.19.1-150300.3.3.1 | < 2.0.19.1-150400.8.3.1
- uwsgi&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 2.0.19.1-150300.3.3.1 | < 2.0.19.1-150400.8.3.1
Alpine1 product
- apache2< 2.4.59-r0
Apache1 product
- http_server≥ 2.4.0, < 2.4.59
Apache software foundation1 product
- apache http server≥ 2.4.0, ≤ 2.4.58
Apple1 product
- macos< 14.6
Broadcom1 product
Fedoraproject1 product
- fedoraEOL38 | 39 | 40
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.22+esm12 | < 2.4.18-2ubuntu3.17+esm12 | < 2.4.29-1ubuntu4.27+esm2 | < 2.4.41-4ubuntu3.17 | < 2.4.52-1ubuntu4.9 | < 2.4.58-1ubuntu8.1
11 vendors · 17 products
References
25 links
lists.debian.org/debian-lts-announce/2024/05/msg00013.htmlX TransferredMailing ListThird Party Advisory- lists.debian.org/debian-lts-announce/2024/05/msg00014.htmlX TransferredMailing ListThird Party Advisory
