BIT-apache-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.30 through 2.4.68 are affected when using mod_proxy_uwsgi. The vulnerable condition involves a crafted uwsgi response containing Transfer-Encoding.

Q: What does an attacker need to exploit it?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Exploitation depends on causing mod_proxy_uwsgi to process a crafted uwsgi response with Transfer-Encoding.

Q: What is the impact of successful exploitation?

The reported severity is high with a CVSS score of 7.5. The vector indicates integrity impact is high, while confidentiality and availability impacts are not reported.

Published Oct 1, 2026

Updated

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

Affected Software

1 affected component

Apache HTTP Server>=2.4.30<=2.4.68

Event History

Oct 1, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.30 through 2.4.68 are affected when using mod_proxy_uwsgi. The vulnerable condition involves a crafted uwsgi response containing Transfer-Encoding.

What does an attacker need to exploit it?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Exploitation depends on causing mod_proxy_uwsgi to process a crafted uwsgi response with Transfer-Encoding.

What is the impact of successful exploitation?

The reported severity is high with a CVSS score of 7.5. The vector indicates integrity impact is high, while confidentiality and availability impacts are not reported.

BIT-apache-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?