CVE-2023-38709: Apache HTTP Server

High severity, CVSS 7.3. EPSS: 3.9% chance of exploitation in the next 30 days.

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

Affected products

• Apache HTTP Server: before 2.4.59 (fixed in 2.4.59)
• Apple macOS: before 14.6 (fixed in 14.6)
• Broadcom Fabric Operating System: affected versions not specified
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 38 only; version 39 only; version 40 only
• Netapp Ontap: version 9 only
• Netapp Ontap Tools: version 10 only

Published 2024-04-04. Last modified 2026-06-17.