AI analysis
Apache HTTP Server 2.4.30 through 2.4.68 has an HTTP response-smuggling flaw (CWE-444) in mod_proxy_uwsgi. A crafted uWSGI backend response that includes Transfer-Encoding can be interpreted inconsistently, so the proxy and a downstream client or cache disagree on where one response ends and the next begins. An attacker who can cause the uWSGI upstream to emit that response may splice or poison later HTTP responses, which can expose other users’ data, poison caches, or bypass response-based controls. Only servers that proxy to uWSGI through mod_proxy_uwsgi in the affected version range are impacted. There is no known public proof-of-concept, CVSS is not yet scored, and the issue is not in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Upgrade Apache HTTP Server to a vendor release newer than 2.4.68 that includes the fix for CVE-2026-63718 as soon as it is published. Until then, unload mod_proxy_uwsgi where uWSGI proxying is not required and review uwsgi:// ProxyPass configurations. No public exploit is known, but apply the update promptly once available.
Affected
| Apache Software Foundation HTTP Server | 2.4.30 through 2.4.68 |
Estimated exposure
large≈10,000–100,000+ servers (subset of millions of Apache httpd installs using mod_proxy_uwsgi) — Public web surveys and internet scans show Apache HTTP Server on millions of sites, but only installs that load mod_proxy_uwsgi are exposed; that module’s install count is not published, so the figure is an order-of-magnitude estimate of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.