CVE-2026-33523

A flaw was found in httpd. When processing responses from an untrusted or compromised backend server, multiple modules fail to sanitize Carriage Return and Line Feed (CRLF) sequences in the HTTP status line. This issue leads to an HTTP response splitting attack.

To exploit this vulnerability, the Apache HTTP Server must be configured to connect to an untrusted or compromised backend server, limiting its exposure. Due to this reason, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that Apache HTTP Server (httpd) is configured to proxy only to trusted backend services. Implement robust network segmentation and access controls to restrict unauthorized access to backend servers. If proxying to potentially untrusted backends is necessary, consider deploying a Web Application Firewall (WAF) or an additional content inspection layer to filter malicious response headers.