CVE-2023-27522

moderate-risk

Published 2023-03-07

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

Do I need to act?

0.78% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (3)

Http Server

Debian Linux

Uwsgi

Affected Vendors

Debian Apache Unbit

References (6)

Vendor Advisory https://httpd.apache.org/security/vulnerabilities_24.html

Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html

Third Party Advisory https://security.gentoo.org/glsa/202309-01

Vendor Advisory https://httpd.apache.org/security/vulnerabilities_24.html

Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html

Third Party Advisory https://security.gentoo.org/glsa/202309-01

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 9/34 · Low