In Apache HTTP Server versions 2.4.0 to 2.4.39, redirects configured using mod_rewrite that are designed to be self-referential can be bypassed by attackers using encoded newline characters within the request URL. This allows the redirect to be altered to an unexpected URL, potentially enabling redirect-based attacks. The vulnerability affects multiple Ubuntu package versions of Apache 2.4.x as listed. No known exploits in the wild have been reported.

The vulnerability allows attackers to manipulate mod_rewrite redirects to point to URLs other than those intended by the server administrator. This could lead to redirecting users to malicious sites, potentially facilitating phishing or other social engineering attacks. The impact is limited to confidentiality and integrity as per the CVSS vector, with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify with their operating system or Apache HTTP Server vendor for available updates or patches addressing this issue. Until patched, administrators should review mod_rewrite redirect rules for potential misuse of encoded newline characters and consider implementing additional validation or filtering of URLs.