Medium severity6.5NVD Advisory· Published May 4, 2026· Updated May 4, 2026

CVE-2026-33523

Description

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.

This issue affects Apache HTTP Server: from through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Apache/Httpdinferred
Range: <=2.4.66
Apache/Http Server
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Range: >=2.4.0,<2.4.67

No patches discovered yet.

AI mechanics synthesis has not run for this CVE yet.