CVE-2026-33523: Apache HTTP Server Response Splitting Flaw

CVE-2026-33523 Overview

CVE-2026-33523 is an HTTP response splitting vulnerability affecting multiple modules in Apache HTTP Server when configured with untrusted or compromised backend servers. The flaw exists in all versions through 2.4.66 and is fixed in version 2.4.67. An attacker controlling a backend service can inject crafted response headers that the front-end Apache instance forwards to clients, splitting the HTTP response stream. This enables cache poisoning, cross-user header injection, and client-side attacks against downstream consumers. The issue is tracked under CWE-443 and was published to the National Vulnerability Database on May 4, 2026.

Critical Impact

Attackers with control of a backend server can split forwarded HTTP responses, enabling cache poisoning and header injection against clients of the Apache front-end.

Affected Products

• Apache HTTP Server versions through 2.4.66
• Reverse proxy and gateway modules including mod_proxy, mod_proxy_http, and related modules used with backend servers
• Deployments fronting untrusted or potentially compromised origin servers

Discovery Timeline

• 2026-05-04 - CVE-2026-33523 published to NVD
• 2026-05-04 - Apache HTTPD security advisory published
• 2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-33523

Vulnerability Analysis

HTTP response splitting occurs when an application incorporates attacker-controlled data into HTTP response headers without sanitizing carriage return (\r) and line feed (\n) characters. In CVE-2026-33523, multiple Apache HTTP Server modules pass headers received from a backend server to clients without enforcing strict header field validation. When Apache acts as a reverse proxy or gateway, a malicious or compromised backend can return headers containing CRLF sequences. Apache forwards these sequences verbatim, allowing the backend to terminate the legitimate response and inject a second, attacker-defined response onto the wire.

The vulnerability requires no authentication and no user interaction at the Apache layer. Exploitation depends on the attacker controlling, compromising, or impersonating a backend the Apache server trusts.

Root Cause

The root cause is insufficient validation of header values received from backend services in Apache's proxy and gateway code paths. The affected modules treat backend-supplied headers as trusted, omitting checks for embedded CRLF byte sequences. This violates RFC 9110 and RFC 9112 header field rules, which prohibit raw CR and LF octets within field values.

Attack Vector

An attacker must control or compromise a backend server reachable through an Apache reverse proxy. The attacker returns a response containing crafted headers with embedded \r\n sequences followed by a second response body. Apache forwards the data unchanged to the client. Caches and intermediaries between Apache and the client may store the injected response, poisoning subsequent requests from other users.

No verified public exploit code was available at publication. Refer to the Apache HTTPD Vulnerability List and the OpenWall OSS Security Discussion for technical details.

Detection Methods for CVE-2026-33523

Indicators of Compromise

• Backend HTTP responses containing raw \r\n sequences embedded within header field values
• Unexpected duplicate HTTP/1.1 status lines or duplicated Content-Length headers in proxy logs
• Cache entries containing response content that does not match the requested resource
• Anomalous Set-Cookie, Location, or Content-Type headers diverging from backend application norms

Detection Strategies

• Inspect Apache mod_proxy and access logs for backend responses with malformed or oversized header lines
• Deploy a network intrusion detection signature that flags %0d%0a or literal CRLF inside response header fields received from upstream servers
• Compare response headers between origin and proxy with an out-of-band probe to detect injection points
• Audit the Apache version reported by httpd -v against the fixed 2.4.67 release

Monitoring Recommendations

• Centralize Apache error_log and proxy logs and alert on AH01 proxy parsing warnings tied to header validation
• Monitor caching layers (Varnish, CDN, mod_cache) for poisoned entries with mismatched Vary or Cache-Control directives
• Track outbound responses from backend services for unexpected header counts or sizes
• Establish baselines for header field length and reject responses exceeding policy thresholds

How to Mitigate CVE-2026-33523

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.67 or later on all front-end and proxy hosts
• Inventory reverse proxy deployments and identify any configurations forwarding traffic from untrusted backends
• Restart httpd after upgrading and validate the running version with httpd -v
• Review backend trust assumptions and segment any backend services that are internet-exposed or third-party-operated

Patch Information

Apache has released version 2.4.67 to address CVE-2026-33523. The fix enforces stricter validation of header field values returned by backend servers in the proxy and gateway modules. Administrators should consult the Apache HTTPD Vulnerability List for distribution-specific package updates and apply vendor-supplied backports where available.

Workarounds

• Restrict mod_proxy configurations to backends under direct administrative control until patching is complete
• Place a header-validating intermediary, such as a Web Application Firewall, between Apache and untrusted backends to strip CRLF from response headers
• Disable unused proxy modules with a2dismod proxy_http on Debian-based systems to reduce exposure
• Enforce TLS and mutual authentication on backend connections to reduce the risk of backend impersonation

# Verify installed Apache version and upgrade
httpd -v

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade apache2

# RHEL/CentOS/Rocky
sudo dnf update httpd

# Confirm fixed version after upgrade
httpd -v | grep -E '2\.4\.(6[7-9]|[7-9][0-9])'

# Reload service
sudo systemctl restart httpd