CVE-2026-63718

A flaw was found in the mod_proxy_uwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentially leading to response tampering or cache poisoning for other users.

Red Hat Product Security rates this flaw with an Important severity because unauthenticated remote attackers can manipulate HTTP stream boundaries to poison web caches or tamper with downstream client responses. Impact is limited to environments where Apache HTTP Server actively handles traffic via the mod_proxy_uwsgi module to backend services. Systems that do not proxy requests to uWSGI endpoints remain unexposed to this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If uWSGI proxy functionality is not required, disable the mod_proxy_uwsgi module:

1. Edit the Apache proxy module configuration file (typically /etc/httpd/conf.modules.d/00-proxy.conf) and comment out the loading directive:

   LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so

2. Restart the Apache HTTP Server daemon: systemctl restart httpd

Warning: Restarting the httpd service causes an immediate disruption to active client connections. Disabling this module will prevent the server from handling requests routed through the uWSGI protocol.