CVE-2024-42516

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
apacheCNA
---
---
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
VendorProductVersion
apachehttp_server
2.4.0 ≤
𝑥
< 2.4.64
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
apache2
bullseye
vulnerable
bullseye (security)
2.4.65-1~deb11u1
fixed
bookworm
2.4.65-1~deb12u1
fixed
bookworm (security)
vulnerable
trixie
2.4.65-2
fixed
forky
2.4.65-3
fixed
sid
2.4.65-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apache2
questing
Fixed 2.4.64-1ubuntu2
released
plucky
Fixed 2.4.63-1ubuntu1.1
released
noble
Fixed 2.4.58-1ubuntu8.7
released
jammy
Fixed 2.4.52-1ubuntu4.15
released
focal
Fixed 2.4.41-4ubuntu3.23+esm2
released
bionic
Fixed 2.4.29-1ubuntu4.27+esm6
released
xenial
Fixed 2.4.18-2ubuntu3.17+esm16
released
trusty
needs-triage
Common Weakness Enumeration
References
https://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2025/07/10/2
http://www.openwall.com/lists/oss-security/2025/07/10/3
https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html