CVE-2026-63718: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

Affected products

• Apache HTTP Server: from 2.4.30, before 2.4.69 (fixed in 2.4.69)

Published 2026-10-01. Last modified 2026-10-06.