CVE-2024-42516

What it actually does

HTTP response splitting in Apache HTTP Server core due to improper validation of Content-Type response headers from hosted or proxied applications, allowing crafted responses to be split into multiple HTTP responses.

Why it matters to the business

Attackers can poison caches, inject malicious content into user responses, or bypass security controls on sites hosted or proxied by the server, potentially leading to widespread compromise of web applications and user trust.

How an attack unfolds

An attacker identifies an application hosted or proxied by Apache HTTP Server that allows manipulation of Content-Type headers, crafts a malicious header value to trigger response splitting, and uses the resulting split to inject additional HTTP responses or headers that affect downstream clients or caches.

How to fix it

Upgrade Apache HTTP Server to version 2.4.64 or apply the fix from commit 7e926454793abd7d71b6afc8bd1ec1648752c6ad in the GIT repository; for Debian 13 systems, update to linux package version 6.12.35-1.

How to confirm the fix worked

Verify server version is at least 2.4.64 or the specified commit/package; test by sending requests with manipulated Content-Type headers and confirm responses are no longer splittable.

Typical attack path

1. Identify target application allowing Content-Type manipulation
2. Craft malicious Content-Type header value containing CRLF sequences
3. Trigger request through Apache HTTP Server
4. Observe split responses enabling header or content injection
5. Leverage injected responses for cache poisoning or client-side attacks

How to detect it

Review Apache access and error logs for requests containing unusual Content-Type headers with CRLF sequences or multiple response indicators; inspect proxy logs for split response artifacts.

What your security team should do

• Prioritize upgrade of all Apache HTTP Server instances to the fixed version
• Review and restrict Content-Type header handling in proxied applications
• Monitor for unusual response patterns post-upgrade