CVE-2026-33523: Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
Other sources
HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.
This issue affects Apache HTTP Server: from through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.67-1 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.67Patch CVE-2026-33523
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33523?
CVE-2026-33523 is classified as a medium severity vulnerability affecting multiple Apache HTTP Server modules.
How do I fix CVE-2026-33523?
To mitigate CVE-2026-33523, upgrade your Apache HTTP Server to version 2.4.67 or later.
What systems are affected by CVE-2026-33523?
CVE-2026-33523 affects Apache HTTP Server versions up to and including 2.4.66.
What type of vulnerability is CVE-2026-33523?
CVE-2026-33523 is an HTTP response splitting vulnerability that can be exploited through untrusted or compromised backend servers.
What can happen if CVE-2026-33523 is exploited?
Exploitation of CVE-2026-33523 can lead to unintended HTTP response behaviors, potentially allowing attackers to manipulate response content.