Medium

Apache HTTP Server multiple modules HTTP response splitting

IdentifiersCVE-2026-33523CWE-443· DEPRECATED: HTTP response splitting

CVE-2026-33523 is an HTTP response splitting vulnerability affecting multiple Apache HTTP Server modules in versions 2.4.0 through 2.4.66. The issue occurs when Apache HTTP Server interacts with an untrusted or compromised backend server and forwards a malicious backend status line to the client. This improper handling of backend-supplied response data can allow crafted CRLF sequences in the status line to influence the downstream HTTP response. Apache describes the flaw as affecting multiple modules and specifically involving forwarding of a malicious status line from backend systems.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker controlling, compromising, or otherwise influencing a backend server behind Apache HTTP Server to manipulate the HTTP response returned to clients. Based on the available scoring and descriptions, the primary impact is low confidentiality and low integrity impact, with no direct availability impact. In practice, this can enable response splitting and downstream response manipulation, potentially causing injection of unintended headers or alteration of response semantics for affected client transactions.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, reduce exposure by avoiding trust in backend servers that Apache forwards responses from, and isolate or harden backend systems so they cannot return attacker-controlled or malformed status lines. Limit use of configurations and modules that forward backend-generated status lines where feasible, and ensure backend services behind Apache are trusted and not compromised. However, the authoritative fix is to upgrade to 2.4.67.

Remediation

Patch, then assume compromise.

Upgrade Apache HTTP Server to version 2.4.67 or later. Apache states that version 2.4.67 fixes this issue, and the fix in the 2.4.x branch is tracked as revision r1933360.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationHttp Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

help net securityNews

May 17, 2026

Debian 13.5 point release lands with security fixes, bug patches - Help Net Security

An HTTP response splitting vulnerability in Apache HTTP Server fixed in Debian 13.5.

msrc microsoftNews

May 7, 2026

CVE-2026-33523 - Security Update Guide - Microsoft - Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

An HTTP response splitting vulnerability in multiple Apache HTTP Server modules involving forwarding a malicious status line.

opennetNews

Dec 25, 2025

� Apache httpd 2.4.67 �� HTTP/2, �� ̣��

Apache HTTP Server vulnerability enabling HTTP response splitting under certain conditions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-33523

NVD

nvd.nist.gov/vuln/detail/CVE-2026-33523

MITRE CWE · CWE-443

DEPRECATED: HTTP response splitting

Vendor Advisory

httpd.apache.org/security/vulnerabilities_24.html

Third Party Advisory

openwall.com/lists/oss-security/2026/05/04/23