Is CVE-2026-63718 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63718 being exploited in the wild.

How severe is CVE-2026-63718?

High severity, with a CVSS score of 7.5, published 1 October 2026.

Which products and versions are affected?

Apache HTTP Server 2.4.30 through 2.4.68.

Is there a fix for CVE-2026-63718?

Yes: fixed in Apache HTTP Server 2.4.69. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63718 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63718?

Check whether you run Apache HTTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63718: Apache HTTP Server response smuggling in mod_proxy_uwsgi

CVE-2026-63718 · Severity: high · CVSS 7.5 · Published 2026-10-01

Apache HTTP Server, a widely-used web server that processes HTTP requests and proxies them to backend services, contains a response smuggling vulnerability in its mod_proxy_uwsgi module. An attacker can craft a malicious uwsgi response with Transfer-Encoding headers to cause the web server to misinterpret HTTP responses, potentially allowing cache poisoning or request smuggling attacks that could affect downstream systems or cached content.

Technologies: Apache HTTP Server. Vendors: Apache.

Quick answers

Is CVE-2026-63718 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63718 being exploited in the wild.
How severe is CVE-2026-63718?: High severity, with a CVSS score of 7.5, published 1 October 2026.
Which products and versions are affected?: Apache HTTP Server 2.4.30 through 2.4.68.
Is there a fix for CVE-2026-63718?: Yes: fixed in Apache HTTP Server 2.4.69. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63718 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63718?: Check whether you run Apache HTTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache HTTP Server 2.4.69

Technical details

This HTTP response smuggling vulnerability exists in mod_proxy_uwsgi due to inconsistent interpretation of Transfer-Encoding headers in crafted uwsgi responses. The vulnerability affects Apache HTTP Server versions 2.4.30 through 2.4.68 and requires network access to a server with mod_proxy_uwsgi enabled proxying to a uWSGI backend. An attacker controlling or able to influence a proxied uWSGI application can inject crafted responses that bypass request/response boundary validation.

Affected products

Apache HTTP Server 2.4.30 through 2.4.68

Timeline

2026-07-14: disclosed: Vulnerability reported to Apache security team
2026-10-01: patched: Fixed in 2.4.x by r1938691
2026-10-01: advisory: Apache HTTP Server 2.4.69 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.