CVE-2023-27522: uwsgi fixed in 2.0.22

CVE-2023-27522 PUBLISHED CVSS 7.5 HIGH

Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

Reported by apache · Published March 7, 2023

uwsgi is fixed in 2.0.22 (PyPI)

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
uwsgi	PyPI	2.0.22
mod_lua	Amazon Linux	2.4.56-1.amzn2023
mod_md	Amazon Linux	2.4.56-1.amzn2
httpd-tools	Amazon Linux	2.4.56-1.amzn2023, 2.4.56-1.amzn2
apache2	Alpine	2.4.56-r0
mod_ldap	Amazon Linux	2.4.56-1.amzn2023, 2.4.56-1.amzn2
mod_ssl	Amazon Linux	1:2.4.56-1.amzn2023, 1:2.4.56-1.amzn2
mod_session	Amazon Linux	2.4.56-1.amzn2023, 2.4.56-1.amzn2
httpd-devel	Amazon Linux	2.4.56-1.amzn2023, 2.4.56-1.amzn2
httpd	Amazon Linux	2.4.56-1.amzn2023, 2.4.56-1.amzn2
httpd-core	Amazon Linux	2.4.56-1.amzn2023
apache	Bitnami	2.4.56

7 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	2.4.30
amazon:2023	mod_lua	0
amazon:2	mod_md	0
amazon:2	httpd-tools	0
alpine	apache2	0
amazon:2	mod_ldap	0
amazon:2023	mod_ssl	0
apache	http_server	2.4.30
amazon:2023	mod_ldap	0
amazon:2	mod_session	0
amazon:2	httpd-devel	0
amazon:2023	httpd	0
amazon:2023	httpd-core	0
PyPI	uWSGI	0
Apache Software Foundation	Apache HTTP Server	2.4.30
amazon:2	httpd-manual	0
amazon:2	httpd	0
amazon:2	httpd-filesystem	0
amazon:2023	httpd-manual	0
amazon:2	mod_ssl	0

…and 6 more

Timeline

Mar 7, 2023 CVE Published
Mar 8, 2023 EPSS Score (30 in total, the first dated here)
Mar 23, 2023 PoC Published
Mar 9, 2026 Security Advisory (23 in total, the first dated here)
Nov 4, 2026 Distribution Patch (20 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-27522
vulnetix vdb fixes CVE-2023-27522

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-27522/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →