UBUNTU-CVE-2026-63718: High severity ubuntu/apache2 vulnerability

Q: Which deployments are exposed to this issue?

Apache HTTP Server deployments using mod_proxy_uwsgi are affected if the Apache HTTP Server version is from 2.4.30 through 2.4.68. The issue involves processing a crafted uwsgi response containing a Transfer-Encoding header.

Q: What does an attacker need to exploit it?

The attacker needs a way to cause Apache, through mod_proxy_uwsgi, to process a crafted uwsgi backend response with Transfer-Encoding. The supplied vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

Q: What is the security impact?

Successful exploitation can affect HTTP response handling and has a high integrity impact. The provided metrics indicate no confidentiality or availability impact.

Published Oct 1, 2026

Updated

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

Affected Software

5 affected componentsFixes available

ubuntu/apache2<2.4.41-4ubuntu3.23+esm9

2.4.41-4ubuntu3.23+esm9

ubuntu/apache2<2.4.52-1ubuntu4.25

2.4.52-1ubuntu4.25

ubuntu/apache2<2.4.58-1ubuntu8.17

2.4.58-1ubuntu8.17

ubuntu/apache2*

ubuntu/apache2<2.4.66-2ubuntu2.6

2.4.66-2ubuntu2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.41-4ubuntu3.23+esm9
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.52-1ubuntu4.25
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.58-1ubuntu8.17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-2ubuntu2.6

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server deployments using mod_proxy_uwsgi are affected if the Apache HTTP Server version is from 2.4.30 through 2.4.68. The issue involves processing a crafted uwsgi response containing a Transfer-Encoding header.

What does an attacker need to exploit it?

The attacker needs a way to cause Apache, through mod_proxy_uwsgi, to process a crafted uwsgi backend response with Transfer-Encoding. The supplied vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

What is the security impact?

Successful exploitation can affect HTTP response handling and has a high integrity impact. The provided metrics indicate no confidentiality or availability impact.

UBUNTU-CVE-2026-63718: High severity ubuntu/apache2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the security impact?