{"id":"CVE-2026-63718","published":"2026-10-01T17:17:30.040","lastModified":"2026-10-06T16:46:24.983","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-444"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/26","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to manipulate HTTP request and response handling in Apache servers using mod_proxy_uwsgi, potentially leading to response smuggling where crafted uwsgi responses can be interpreted inconsistently by the server. This creates a high-risk scenario for data integrity and can enable further attacks through manipulated HTTP communications.","exploitability":"Exploitation requires sending a specially crafted uwsgi response through mod_proxy_uwsgi, which is moderately difficult without prior access to the affected proxy configuration but becomes more feasible when attackers can influence uwsgi backend responses.","blast_radius":"If exploited, this vulnerability could affect all Apache HTTP Server instances using mod_proxy_uwsgi with uwsgi backends, potentially allowing attackers to manipulate responses and inject malicious content across multiple web applications.","remediation":"Upgrade to Apache HTTP Server 2.4.69 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","http","proxy","smuggling"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:04:06.437Z"}}