Apache HTTP Server: HTTP response splitting

Apache HTTP Server fails to properly validate certain inputs, allowing attackers to manipulate HTTP responses by injecting extra headers or content. This can lead to cache poisoning, session hijacking, or tricking users into seeing malicious content.

Improper input validation in Apache's core allows backend or content generators to inject control characters that split HTTP responses, enabling HTTP response splitting attacks. An attacker with control over backend-generated content can inject headers or payload boundaries to poison caches or perform client-side attacks against end users.