CVE-2023-27522: Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling
Summary
CVE-2023-27522: Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling. Affects uwsgi versions < 2.0.22. Fixed in 2.0.22. How to fix ↓
Also tracked for
The same CVE-2023-27522 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server is a widely used open-source web server software. It provides a secure and efficient platform for serving web content. The mod_proxy_uwsgi module in Apache HTTP Server allows for proxying requests to a uWSGI server. uWSGI is a fast, self-healing, and developer-friendly application server for Python web applications. This vulnerability affects Apache HTTP Server versions 2.4.30 through 2.4.55 and the uWSGI PyPI package prior to version 2.0.22. The mod_proxy_uwsgi module fails to properly handle special characters in the origin response header, leading to potential HTTP response smuggling. An attacker can exploit this vulnerability to manipulate the response forwarded to the client, potentially causing security issues or information disclosure.
Vulnerability Detail
The vulnerability arises due to a failure in the mod_proxy_uwsgi module of Apache HTTP Server. When processing the origin response header, special characters can cause the response to be truncated or split, leading to HTTP response smuggling. This can result in various security risks, such as bypassing security controls, injecting malicious content, or exposing sensitive information. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It affects Apache HTTP Server versions 2.4.30 through 2.4.55 and the uWSGI PyPI package prior to version 2.0.22.
How To Fix
Latest published version: 2.0.31 as of 23 Oct 2026
pip install --upgrade "uwsgi==2.0.31"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.22
This is the first release that contains the fix.
pip install --upgrade "uwsgi==2.0.22"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the software is not immediately feasible, a temporary workaround can be implemented. The mod_headers module in Apache HTTP Server can be used to sanitize the origin response header by removing or encoding special characters. Here is an example configuration snippet for Apache's httpd.conf file:
<IfModule mod_headers.c>
RequestHeader unset Origin
RequestHeader edit Origin "^http:\/\/([^\/]+)$" "http://$1"
</IfModule>
This workaround helps mitigate the vulnerability by modifying the Origin header to prevent the exploitation of special characters.
Conclusion
The Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling vulnerability poses a significant risk to web servers using affected versions. It is crucial to promptly apply the recommended updates or implement the provided workaround to mitigate the vulnerability. Regularly updating software components and staying informed about security advisories is essential for maintaining a secure web server environment. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for uwsgi →
FAQ
Apache HTTP Server is a popular open-source web server software that provides a secure and efficient platform for serving web content.
mod_proxy_uwsgi is a module in Apache HTTP Server that allows for proxying requests to a uWSGI server. uWSGI is an application server for Python web applications.
HTTP response smuggling is a technique where an attacker manipulates the HTTP response to bypass security controls, inject malicious content, or expose sensitive information.
This vulnerability can lead to security risks such as bypassing security controls, injecting malicious content, or exposing sensitive information.
To fix this vulnerability, it is recommended to upgrade Apache HTTP Server to version 2.4.56 or later and update the uWSGI PyPI package to version 2.0.22 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for uwsgi.
