CVE-2024-42516·Apache vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.31% — higher than 54% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2024-42516 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.31%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.64 or later to patch a response-splitting vulnerability that could allow attackers to inject malicious HTTP headers. Organizations running versions 2.4.0 through 2.4.63 should prioritize this update, particularly if the server processes user-controlled or application-provided Content-Type headers. This vulnerability was initially addressed in 2.4.59 but the fix was incomplete, making 2.4.64 the first fully patched release.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET .* HTTP/1\.1\r\nContent-Type:[^\r]*(%0d|%0a|\r|\n)+[A-Za-z-]+:|^[^\r]*\r\n\r\n[A-Za-z-]+: [^\r]*\r\n

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement a WAF rule to block HTTP requests with CRLF sequences (%0d, %0a, \r, \n) in the Content-Type header or any response header fields. Additionally, reject requests with malformed or duplicate Content-Type headers that could be used to inject response data.

How to check if you are affected

1. Check installed Apache version: apache2ctl -v (Ubuntu/Debian) or httpd -v (RHEL/CentOS/Amazon Linux)
2. Verify the server is exposed to untrusted client connections by checking firewall rules and virtual host configurations: grep -r 'VirtualHost' /etc/apache2/sites-enabled/ or /etc/httpd/conf/
3. Search Apache access and error logs for suspicious Content-Type header patterns or CRLF injection attempts: grep -E '(%0d|%0a|\r|\n)' /var/log/apache2/access.log* or /var/log/httpd/access_log*
4. Confirm the patched version is running after upgrade: apache2ctl -v or httpd -v (should show 2.4.64 or higher)

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2025/07/10/2
• http://www.openwall.com/lists/oss-security/2025/07/10/3
• https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html