Description
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which fixes this issue.
Remediation
References
Related Vulnerabilities
Internet Information Services Other Vulnerability (CVE-2001-0507)
Jetty Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-28163)
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6606)
Chamilo Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-29041)