Search for vulnerabilities
Vulnerability details: VCID-yu6g-bnxs-rfbt
Vulnerability ID VCID-yu6g-bnxs-rfbt
Aliases CVE-2023-27522
GHSA-vcph-37mh-fqrh
Summary HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-27522.json
epss 0.00442 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.00442 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0072 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0074 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
epss 0.0074 https://api.first.org/data/v1/epss?cve=CVE-2023-27522
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-vcph-37mh-fqrh
cvssv3.1 7.5 https://github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d
generic_textual HIGH https://github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d
cvssv3.1 7.5 https://github.com/unbit/uwsgi
generic_textual HIGH https://github.com/unbit/uwsgi
cvssv3.1 7.5 https://github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822
generic_textual HIGH https://github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822
cvssv3.1 7.5 https://github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569
generic_textual HIGH https://github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569
cvssv3.1 7.5 https://httpd.apache.org/security/vulnerabilities_24.html
generic_textual HIGH https://httpd.apache.org/security/vulnerabilities_24.html
ssvc Track https://httpd.apache.org/security/vulnerabilities_24.html
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-27522
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-27522
cvssv3.1 7.5 https://security.gentoo.org/glsa/202309-01
generic_textual HIGH https://security.gentoo.org/glsa/202309-01
ssvc Track https://security.gentoo.org/glsa/202309-01
cvssv3.1 7.5 https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.html
generic_textual HIGH https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-27522.json
https://api.first.org/data/v1/epss?cve=CVE-2023-27522
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-20001
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36760
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37436
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25690
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27522
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d
https://github.com/unbit/uwsgi
https://github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822
https://github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
https://nvd.nist.gov/vuln/detail/CVE-2023-27522
https://security.gentoo.org/glsa/202309-01
https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.html
1032476 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032476
2176211 https://bugzilla.redhat.com/show_bug.cgi?id=2176211
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
cpe:2.3:a:unbit:uwsgi:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:unbit:uwsgi:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2023-27522 https://httpd.apache.org/security/json/CVE-2023-27522.json
GHSA-vcph-37mh-fqrh https://github.com/advisories/GHSA-vcph-37mh-fqrh
RHSA-2023:4628 https://access.redhat.com/errata/RHSA-2023:4628
RHSA-2023:4629 https://access.redhat.com/errata/RHSA-2023:4629
RHSA-2023:5049 https://access.redhat.com/errata/RHSA-2023:5049
RHSA-2023:5050 https://access.redhat.com/errata/RHSA-2023:5050
RHSA-2023:6403 https://access.redhat.com/errata/RHSA-2023:6403
RHSA-2024:4504 https://access.redhat.com/errata/RHSA-2024:4504
USN-5942-1 https://usn.ubuntu.com/5942-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-27522.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/unbit/uwsgi
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://httpd.apache.org/security/vulnerabilities_24.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-23T16:41:55Z/ Found at https://httpd.apache.org/security/vulnerabilities_24.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-23T16:41:55Z/ Found at https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-27522
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://security.gentoo.org/glsa/202309-01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-23T16:41:55Z/ Found at https://security.gentoo.org/glsa/202309-01
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.62543
EPSS Score 0.00442
Published At Aug. 2, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:28:29.346760+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.18/main.json 37.0.0