Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-c4yn-btaf-3ueq
Vulnerability ID VCID-c4yn-btaf-3ueq
Aliases CVE-2023-25690
Summary
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
System Score Found at
cvssv3.1 9.8 http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html
ssvc Track* http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25690.json
epss 0.67011 https://api.first.org/data/v1/epss?cve=CVE-2023-25690
epss 0.67011 https://api.first.org/data/v1/epss?cve=CVE-2023-25690
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 9.8 https://httpd.apache.org/security/vulnerabilities_24.html
ssvc Track* https://httpd.apache.org/security/vulnerabilities_24.html
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
ssvc Track* https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
cvssv3.1 9.8 https://security.gentoo.org/glsa/202309-01
ssvc Track* https://security.gentoo.org/glsa/202309-01
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25690.json
https://api.first.org/data/v1/epss?cve=CVE-2023-25690
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-20001
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36760
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37436
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25690
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27522
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1032476 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032476
2176209 https://bugzilla.redhat.com/show_bug.cgi?id=2176209
Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html
CVE-2023-25690 https://httpd.apache.org/security/json/CVE-2023-25690.json
RHSA-2023:1547 https://access.redhat.com/errata/RHSA-2023:1547
RHSA-2023:1593 https://access.redhat.com/errata/RHSA-2023:1593
RHSA-2023:1596 https://access.redhat.com/errata/RHSA-2023:1596
RHSA-2023:1597 https://access.redhat.com/errata/RHSA-2023:1597
RHSA-2023:1670 https://access.redhat.com/errata/RHSA-2023:1670
RHSA-2023:1672 https://access.redhat.com/errata/RHSA-2023:1672
RHSA-2023:1673 https://access.redhat.com/errata/RHSA-2023:1673
RHSA-2023:1916 https://access.redhat.com/errata/RHSA-2023:1916
RHSA-2023:3292 https://access.redhat.com/errata/RHSA-2023:3292
RHSA-2023:3354 https://access.redhat.com/errata/RHSA-2023:3354
RHSA-2023:3355 https://access.redhat.com/errata/RHSA-2023:3355
USN-5942-1 https://usn.ubuntu.com/5942-1/
USN-5942-2 https://usn.ubuntu.com/5942-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-18T15:37:02Z/ Found at http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25690.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://httpd.apache.org/security/vulnerabilities_24.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-18T15:37:02Z/ Found at https://httpd.apache.org/security/vulnerabilities_24.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-18T15:37:02Z/ Found at https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202309-01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-18T15:37:02Z/ Found at https://security.gentoo.org/glsa/202309-01
Exploit Prediction Scoring System (EPSS)
Percentile 0.9857
EPSS Score 0.67011
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:53:51.394726+00:00 Apache HTTPD Importer Import https://httpd.apache.org/security/json/CVE-2023-25690.json 38.6.0