https://seclists.org/oss-sec/2026/q4/25: CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding sponse smuggling

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.30 through 2.4.68 are affected when mod_proxy_uwsgi is used. The issue involves a crafted uwsgi response containing Transfer-Encoding.

Q: What must an attacker be able to do to exploit it?

An attacker needs a way to cause or control a crafted response from the proxied uwsgi service. The vulnerable behavior is triggered through mod_proxy_uwsgi's handling of Transfer-Encoding in that response.

Q: What version contains the fix?

Apache HTTP Server 2.4.69 includes the fix. The fix was made in the 2.4.x branch by revision r1938691 on 2026-10-01.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.30<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.30 through 2.4.68 are affected when mod_proxy_uwsgi is used. The issue involves a crafted uwsgi response containing Transfer-Encoding.

What must an attacker be able to do to exploit it?

An attacker needs a way to cause or control a crafted response from the proxied uwsgi service. The vulnerable behavior is triggered through mod_proxy_uwsgi's handling of Transfer-Encoding in that response.

What version contains the fix?

Apache HTTP Server 2.4.69 includes the fix. The fix was made in the 2.4.x branch by revision r1938691 on 2026-10-01.