The vulnerability is a response splitting flaw located in several modules of the Apache HTTP Server. It allows attackers to insert malicious header lines through untrusted or compromised backend servers, which can lead to the injection of arbitrary HTTP headers and status lines into the response stream. This weakness is categorized as CWE-443 and NVD-CWE-Other and can enable attackers to manipulate the server’s output for potential downstream attacks such as cache poisoning, session fixation, or cross‑site scripting, depending on how the injected headers are processed by clients.

Apache HTTP Server versions up to and including 2.4.66 are affected. The software is distributed by the Apache Software Foundation.

There is no EPSS score or KEV listing available in the data, but the CVSS score of 6.5 indicates a moderate severity flaw. Nevertheless, the flaw permits an attacker to alter HTTP headers sent by the server, an action that can be leveraged in many attack scenarios. Because the flaw originates from untrusted backend data, an attacker with control over a backend service can exploit the vulnerability without needing further permissions on the Apache instance itself. The moderate CVSS score combined with the potential for widespread HTTP manipulation suggests a significant risk level in environments that rely on untrusted backend responses.