CVE-2024-42516 Apache HTTP Server: HTTP response splitting
Attackers can split HTTP responses by manipulating Content-Type headers, potentially leading to cache poisoning or XSS, affecting Apache HTTP Server users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42516?
CVE-2024-42516 is a high-severity vulnerability in Apache Http Server, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.
This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.
Users are recommended to upgrade to version 2.4.64, which fixes this issue.
Weakness: CWE-20
Which versions are affected by CVE-2024-42516?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.0 | 2.4.64 |
Products include Apache Http Server.
How do I fix CVE-2024-42516?
Upgrade apache to 2.4.64 or later.
Is CVE-2024-42516 being exploited?
There is no known exploitation of CVE-2024-42516 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2024-42516, AZL-65130, AZL-65139, AZL-65166, AZL-65214, BELL-CVE-2024-42516 and 8 more.