CVE-2023-38709

Apache HTTP Server: HTTP response splitting

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

We have discovered 1,393,650 live websites that are affected by CVE-2023-38709.

Run a Free Instant Scan



Affected Software

Product  Apache
Category Web Servers
Vulnerable Domains1,393,650 live websites (55% of Apache install base)
Vulnerable Versions
  • from 0 through 2.4.58
Vulnerable Versions Count111 versions ( 91% of all versions)



Details

  • Published - Apr 4, 2024
  • Updated - Nov 4, 2025

Credits

  • Orange Tsai (@orange_8361) from DEVCORE (finder)

Website Distribution by Country

Number of websites using CVE-2023-38709
United States373,495 websites


Germany150,715 websites
Taiwan110,475 websites
France69,458 websites
Japan64,824 websites
Russia54,572 websites
Italy45,173 websites
Netherlands44,682 websites
Czech Republic39,856 websites
GB31,747 websites

Website Distribution by TLD

Number of websites using CVE-2023-38709
.com547,690 websites
.de93,800 websites
.org60,870 websites
.net56,162 websites
.ru47,662 websites
.it39,323 websites
.nl33,559 websites
.cz32,814 websites
.jp26,155 websites
.pl23,218 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2023-38709

Top websites that are affected by CVE-2023-38709. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.***.****.****.************.net United States***
*****.***********.com Canada***
*********.net United States***
****************.net United States*,***
***.****.us United States*,***
***.*********.com Singapore*,***
*****.*******.com Singapore*,***
******.net Sweden*,***
******************.com United States*,***
*******.**.com United States*,***
See full domain list

FAQ

A total of 1,393,650 websites have been identified as vulnerable to CVE-2023-38709, based on global website indexing conducted by WebTechSurvey.
The Apache is affected by the CVE-2023-38709 vulnerability.
Apache versions up to and including 2.4.58 are vulnerable to CVE-2023-38709.