CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Apache HTTP Server 2.4.30 through 2.4.68 has an HTTP response-smuggling flaw (CWE-444) in mod_proxy_uwsgi. A crafted uWSGI backend response that includes Transfer-Encoding can be interpreted inconsistently, so the proxy and a downstream client or cache disagree on where one response ends and the next begins. An attacker who can cause the uWSGI upstream to emit that response may splice or poison later HTTP responses, which can expose other users’ data, poison caches, or bypass response-based controls. Only servers that proxy to uWSGI through mod_proxy_uwsgi in the affected version range are impacted. There is no known public proof-of-concept, CVSS is not yet scored, and the issue is not in CISA’s Known Exploited Vulnerabilities catalog.