PT-2026-36815 · Apache+2 · Apache Http Server+2

Dawit Jeong + 2 · Published 2026-03-05 · Updated 2026-05-22 · CVE-2026-33523

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.67

Description HTTP response splitting occurs in multiple Apache HTTP Server modules when interacting with untrusted or compromised backend servers. This issue allows an attacker to split an HTTP response, potentially leading to cache poisoning or cross-site scripting.

Recommendations Upgrade to version 2.4.67.

Fix

DoS

Weakness Enumeration

CWE-113

CWE-443

Related Identifiers

BDU:2026-06310

BIT-APACHE-2026-33523

CVE-2026-33523

OESA-2026-2320

OESA-2026-2398

OESA-2026-2400

OESA-2026-2401

OESA-2026-2402

OPENSUSE-SU-2026:10785-1

USN-8239-1

Affected Products

Apache Http Server

Linuxmint

Ubuntu

References · 62

• https://ubuntu.com/security/CVE-2026-33006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24072 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2401 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28780 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33007 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33523 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33523 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2320 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33523 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33857 · Security Note
• https://bdu.fstec.ru/vul/2026-06310 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34059 · Security Note