SB2026101226 - IBM Cloud Pak System update for Apache HTTP Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101226

SB2026101226 - IBM Cloud Pak System update for Apache HTTP Server

Published: October 12, 2026

Security Bulletin ID SB2026101226
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) HTTP response splitting (CVE-ID: CVE-2024-24795)

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not correctly process CRLF character sequences in multiple modules. A remote attacker can inject malicious response headers into backend applications and perform an HTTP desynchronization attack.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.


Remediation

Install update from vendor's website.

References