CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Apache HTTP Server: modproxyuwsgi Transfer-Encoding response smuggling
Other sources
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.69-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache HTTP Server versions 2.4.30 through 2.4.68 are affected when mod_proxy_uwsgi is used. The issue involves processing a crafted uWSGI response containing Transfer-Encoding.
What must an attacker be able to do to exploit it?
An attacker needs to cause or control a crafted response from a uWSGI backend that is proxied through mod_proxy_uwsgi. The provided information does not establish exploitation through ordinary client requests alone.