Critical DLA-3401-1 2 CVEs

apache2 - security update

Published Apr 24, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	apache2	2.4.38-3+deb10u10

Vulnerabilities 2

Critical 9.8

CVE-2023-25690 Public exploit EPSS 84%

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Mar 7, 2023
High 7.5

CVE-2023-27522

Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine PyPI

Mar 7, 2023