CVE-2023-38709

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions through 2.4.58

Description The issue is related to faulty input validation in the core of Apache, allowing malicious or exploitable backend/content generators to split HTTP responses. This can be exploited by a remote attacker to perform HTTP response splitting attacks. The vulnerability is associated with the failure to handle CRLF sequences in HTTP headers.

Recommendations For Apache HTTP Server versions through 2.4.58, update to a version newer than 2.4.58 to resolve the issue. As a temporary workaround, consider restricting access to vulnerable backend or content generators to minimize the risk of exploitation. Avoid using HTTP headers that may contain malicious CRLF sequences until the issue is resolved.