CVE-2024-24795
Medium
Description
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
SeverityMedium
CVSS6.3
Exploit probability—
Product
Apache Http Server
PublishedApr 4, 2024
First seenApr 4, 2024
Weakness typeCWE-113CWE-113
How to fix
Update
- apache http_server2.4.59 or later
- apple macos14.6 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.4.0 ≤ v < 2.4.59 | 2.4.59 |
| debian debian_linux | 10.0 | — |
| fedoraproject fedora | 38, 39, 40 | — |
| netapp ontap | 9 | — |
| netapp ontap_tools | 10 | — |
| broadcom fabric_operating_system | No range specified | — |
| apple macos | v < 14.6 | 14.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.