HTTP Response Splitting in Apache HTTP Server Modules
CVE-2026-33523

6.5MEDIUM

Key Information:

Vendor: Apache
Status: Apache Http Server
Vendor: CVE Published:; 4 May 2026

What is CVE-2026-33523?

An HTTP response splitting vulnerability exists in multiple modules of Apache HTTP Server due to the handling of untrusted or compromised backend servers. This flaw allows attackers to manipulate HTTP responses, potentially leading to unauthorized access, data leakage, or web cache poisoning. It affects versions of Apache HTTP Server up to 2.4.66. Users are advised to upgrade to version 2.4.67 to address this critical security issue effectively.

Affected Version(s)

Apache HTTP Server 2.4.0 <= 2.4.66

References

https://httpd.apache.org/security/vulnerabilities_24.html

vendor-advisory

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 4, 2026
Vulnerability Reserved
Mar 20, 2026

Credit

Haruki Oyama (Waseda University)

Merih Mengisteab

Dawit Jeong

CVE-2026-33523 Data

JSON