PT-2023-9026 · Apache+11 · Apache Http Server+11

Yeto · Published 2023-09-06 · Updated 2026-05-28 · CVE-2024-24795

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.59

Description The issue is related to HTTP Response splitting in multiple modules in Apache HTTP Server, which allows an attacker to inject malicious response headers into backend applications, causing an HTTP desynchronization attack. This can be exploited by a remote attacker.

Recommendations To resolve the issue, upgrade to version 2.4.59, which fixes this issue. As a temporary workaround, consider restricting access to vulnerable modules to minimize the risk of exploitation.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

CWE-113

Related Identifiers

ALSA-2024:9306

ALT-PU-2024-5986

ALT-PU-2024-5990

ALT-PU-2024-6193

ALT-PU-2024-6194

AZL-39997

AZL-40040

BDU:2024-03102

BIT-APACHE-2024-24795

CVE-2024-24795

DLA-3818-1

DLA-3819-1

DLA-4158-1

DSA-5662-1

INFSA-2024_9306

MGASA-2024-0118

OESA-2024-1553

OPENSUSE-SU-2024:14463-1

OPENSUSE-SU-2024_1963-1

OPENSUSE-SU-2024_3853-1

OPENSUSE-SU-2024_3861-1

RHSA-2024:9306

RHSA-2024_9306

RHSA-2025:3452

RLSA-2024:9306

SUSE-SU-2024:1627-1

SUSE-SU-2024:1788-1

SUSE-SU-2024:1868-1

SUSE-SU-2024:1963-1

SUSE-SU-2024:3853-1

SUSE-SU-2024:3861-1

USN-6729-1

USN-6729-2

USN-6729-3

USN-8338-1

Affected Products

Alt Linux

Almalinux

Apache Http Server

Astra Linux

Debian

Linuxmint

Apple Macos

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 118

• 🔥 https://github.com/lockness-Ko/CVE-2024-27316 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:14463-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3818-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-24795 · Security Note
• https://ubuntu.com/security/CVE-2025-65082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66200 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1553 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4158-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39573 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6729-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24795#use-case · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38709 · Security Note
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8338-1 · Vendor Advisory