CVE-2024-24795

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

• CWE-113
• CWE-444

• https://httpd.apache.org/security/vulnerabilities_24.htmlRelease Notes, Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Jul/18Mailing List
• http://www.openwall.com/lists/oss-security/2024/04/04/5Mailing List
• https://httpd.apache.org/security/vulnerabilities_24.htmlRelease Notes, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/05/msg00013.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/05/msg00014.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNV4SZAPVS43DZWNFU7XBYYOZEZMI4ZC/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240415-0013/Third Party Advisory
• https://support.apple.com/kb/HT214119Third Party Advisory

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2479A vulnerability classified as problematic has been found in …3.5
• CVE-2024-24790The various Is methods (IsPrivate, IsLoopback, etc) did not …9.8
• CVE-2024-24791The net/http HTTP/1.1 client mishandled the case where a ser…7.5
• CVE-2024-24792Parsing a corrupt or malicious image with invalid color indi…7.5
• CVE-2024-24793A use-after-free vulnerability exists in the DICOM Element P…9.8
• CVE-2024-24794A use-after-free vulnerability exists in the DICOM Element P…9.8
• CVE-2024-24796Deserialization of Untrusted Data vulnerability in MagePeopl…8.8
• CVE-2024-24797Deserialization of Untrusted Data vulnerability in G5Theme E…9.8
• CVE-2024-24798Cross-Site Request Forgery (CSRF) vulnerability in SoniNow T…8.8
• CVE-2024-24799Missing Authorization vulnerability in WooCommerce WooCommer…8.8
• CVE-2024-2480A vulnerability classified as critical was found in MHA Sist…8.8
• CVE-2024-24800Improper Neutralization of Input During Web Page Generation …7.1