Search for vulnerabilities
Vulnerability details: VCID-d9nf-3bb3-fydp
Vulnerability ID VCID-d9nf-3bb3-fydp
Aliases CVE-2024-42516
Summary HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which fixes this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.1
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
System Score Found at
cvssv3 6.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-42516.json
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00265 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00265 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00265 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00265 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00265 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
epss 0.00432 https://api.first.org/data/v1/epss?cve=CVE-2024-42516
cvssv3.1 4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://httpd.apache.org/security/vulnerabilities_24.html
ssvc Track https://httpd.apache.org/security/vulnerabilities_24.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-42516.json
https://api.first.org/data/v1/epss?cve=CVE-2024-42516
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42516
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://httpd.apache.org/security/vulnerabilities_24.html
2374549 https://bugzilla.redhat.com/show_bug.cgi?id=2374549
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
CVE-2024-42516 https://httpd.apache.org/security/json/CVE-2024-42516.json
CVE-2024-42516 https://nvd.nist.gov/vuln/detail/CVE-2024-42516
USN-7639-1 https://usn.ubuntu.com/7639-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-42516.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://httpd.apache.org/security/vulnerabilities_24.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-11T16:07:07Z/ Found at https://httpd.apache.org/security/vulnerabilities_24.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.49139
EPSS Score 0.00259
Published At Aug. 4, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:28:33.212145+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.20/main.json 37.0.0