Apache Http Server (Apache Software Foundation) - vulnerabilities (CVEs)

138 CVEs, 20 in the last 30 days, 39 known versions, newest CVE from 2026-10-01. Vendor: Apache Software Foundation.

CVEs of Apache Http Server

CVE-2026-63686 - CVSS 7.5 (high), 2026-10-01: A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server…
CVE-2026-93546 - CVSS 8.8 (high), 2026-10-01: Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and…
CVE-2026-79768 - CVSS 5.3 (medium), 2026-10-01: Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir…
CVE-2026-73637 - CVSS 7.3 (high), 2026-10-01: Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to…
CVE-2026-73636 - CVSS 8.1 (high), 2026-10-01: Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle…
CVE-2026-63718 - CVSS 7.5 (high), 2026-10-01: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi…
CVE-2026-63292 - CVSS 7.5 (high), 2026-10-01: Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to…
CVE-2026-63045 - CVSS 7.5 (high), 2026-10-01: Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in…
CVE-2026-59797 - CVSS 9.8 (critical), 2026-10-01: Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP…
CVE-2026-59685 - CVSS 7.5 (high), 2026-10-01: Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects…
CVE-2026-58415 - CVSS 5.3 (medium), 2026-10-01: Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a…
CVE-2026-57941 - CVSS 9.8 (critical), 2026-10-01: Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through…
CVE-2026-56449 - CVSS 7.5 (high), 2026-10-01: Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version…
CVE-2026-56154 - CVSS 9.8 (critical), 2026-10-01: Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0…
CVE-2026-56153 - CVSS 7.5 (high), 2026-10-01: Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVE-2026-48005 - CVSS 7.5 (high), 2026-10-01: Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated…
CVE-2026-47360 - CVSS 7.5 (high), 2026-10-01: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes…
CVE-2026-46729 - CVSS 7.5 (high), 2026-10-01: NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0…
CVE-2026-42356 - CVSS 3.7 (low), 2026-10-01: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and…
CVE-2026-42528 - CVSS 4.3 (medium), 2026-10-01: A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child…
CVE-2026-49975 - CVSS 7.5 (high), 2026-06-08: Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue…
CVE-2026-48913 - CVSS 7.3 (high), 2026-06-08: Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from…
CVE-2026-44119 - CVSS 5.5 (medium), 2026-06-08: Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the…
CVE-2026-44631 - CVSS 9.8 (critical), 2026-06-08: Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0…
CVE-2026-43951 - CVSS 6.5 (medium), 2026-06-08: Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server:…
CVE-2026-44186 - CVSS 7.3 (high), 2026-06-08: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP…
CVE-2026-44185 - CVSS 7.3 (high), 2026-06-08: Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server:…
CVE-2026-42535 - CVSS 9.1 (critical), 2026-06-08: A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases,…
CVE-2026-42536 - CVSS 7.5 (high), 2026-06-08: Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server:…
CVE-2026-29170 - CVSS 6.1 (medium), 2026-06-08: A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP…
CVE-2026-34356 - CVSS 7.5 (high), 2026-06-08: Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP…
CVE-2026-34355 - CVSS 7.5 (high), 2026-06-08: A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to…
CVE-2026-29167 - CVSS 9.8 (critical), 2026-06-08: Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through…
CVE-2026-28780 - CVSS 9.8 (critical), 2026-05-05: Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send…
CVE-2026-33007 - CVSS 5.3 (medium), 2026-05-04: A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in…
CVE-2026-33523 - CVSS 6.5 (medium), 2026-05-04: HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP…
CVE-2026-23918 - CVSS 8.8 (high), 2026-05-04: Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are…
CVE-2026-33006 - CVSS 4.8 (medium), 2026-05-04: A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to…
CVE-2026-29169 - CVSS 7.5 (high), 2026-05-04: A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious…
CVE-2026-34032 - CVSS 5.3 (medium), 2026-05-04: Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are…
CVE-2026-33857 - CVSS 5.3 (medium), 2026-05-04: Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to…
CVE-2026-34059 - CVSS 7.5 (high), 2026-05-04: Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version…
CVE-2026-24072 - CVSS 8.8 (high), 2026-05-04: An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the…
CVE-2025-58098 - CVSS 8.3 (high), 2025-12-05: Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec…
CVE-2025-66200 - CVSS 5.4 (medium), 2025-12-05: mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can…
CVE-2025-65082 - CVSS 6.5 (medium), 2025-12-05: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache…
CVE-2025-59775 - CVSS 7.5 (high), 2025-12-05: Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially…
CVE-2025-55753 - CVSS 7.5 (high), 2025-12-05: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff…
CVE-2025-54090 - CVSS 6.3 (medium), 2025-07-23: A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which…
CVE-2025-49630 - CVSS 7.5 (high), 2025-07-10: In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients…
CVE-2025-53020 - CVSS 7.5 (high), 2025-07-10: Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users…
CVE-2025-49812 - CVSS 7.4 (high), 2025-07-10: In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to…
CVE-2024-43394 - CVSS 7.5 (high), 2025-07-10: Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache…
CVE-2025-23048 - CVSS 9.1 (critical), 2025-07-10: In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session…
CVE-2024-47252 - CVSS 7.5 (high), 2025-07-10: Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters…
CVE-2024-43204 - CVSS 7.5 (high), 2025-07-10: SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely…
CVE-2024-42516 - CVSS 7.5 (high), 2025-07-10: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or…
CVE-2024-40898 - CVSS 9.1 (critical), 2024-07-18: SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and…
CVE-2024-40725 - CVSS 5.3 (medium), 2024-07-18: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers.…
CVE-2024-39884 - CVSS 6.2 (medium), 2024-07-04: A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar…
CVE-2024-39573 - CVSS 7.5 (high), 2024-07-01: Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be…
CVE-2024-38477 - CVSS 7.5 (high), 2024-07-01: null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are…
CVE-2024-38475 - CVSS 9.1 (critical), 2024-07-01: Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted…
CVE-2024-38474 - CVSS 9.8 (critical), 2024-07-01: Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the…
CVE-2024-38473 - CVSS 8.1 (high), 2024-07-01: Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially…
CVE-2024-38476 - CVSS 9.8 (critical), 2024-07-01: Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend…
CVE-2024-38472 - CVSS 7.5 (high), 2024-07-01: SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are…
CVE-2024-36387 - CVSS 5.4 (medium), 2024-07-01: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading…
CVE-2023-38709 - CVSS 7.3 (high), 2024-04-04: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache…
CVE-2024-27316 - CVSS 7.5 (high), 2024-04-04: HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not…
CVE-2024-24795 - CVSS 6.3 (medium), 2024-04-04: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to…
CVE-2023-31122 - CVSS 7.5 (high), 2023-10-23: Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
CVE-2023-45802 - CVSS 5.9 (medium), 2023-10-23: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead,…
CVE-2023-43622 - CVSS 7.5 (high), 2023-10-23: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server.…
CVE-2023-27522 - CVSS 7.5 (high), 2023-03-07: HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special…
CVE-2023-25690 - CVSS 9.8 (critical), 2023-03-07: Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when…
CVE-2022-37436 - CVSS 5.3 (medium), 2023-01-17: Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated…
CVE-2022-36760 - CVSS 9 (critical), 2023-01-17: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle…
CVE-2006-20001 - CVSS 7.5 (high), 2023-01-17: A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent.…
CVE-2022-31813 - CVSS 9.8 (critical), 2022-06-09: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism.…
CVE-2022-26377 - CVSS 7.5 (high), 2022-06-09: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle…
CVE-2022-28615 - CVSS 9.1 (critical), 2022-06-09: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large…
CVE-2022-30556 - CVSS 7.5 (high), 2022-06-09: Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
CVE-2022-28614 - CVSS 5.3 (medium), 2022-06-09: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input…
CVE-2022-30522 - CVSS 7.5 (high), 2022-06-09: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make…
CVE-2022-28330 - CVSS 5.3 (medium), 2022-06-09: Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
CVE-2022-29404 - CVSS 7.5 (high), 2022-06-09: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit…
CVE-2022-22720 - CVSS 9.8 (critical), 2022-03-14: Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP…
CVE-2022-22719 - CVSS 7.5 (high), 2022-03-14: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52…
CVE-2022-23943 - CVSS 9.8 (critical), 2022-03-14: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This…
CVE-2022-22721 - CVSS 9.1 (critical), 2022-03-14: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out…
CVE-2021-44224 - CVSS 8.2 (high), 2021-12-20: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing…
CVE-2021-44790 - CVSS 9.8 (critical), 2021-12-20: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is…
CVE-2021-42013 - CVSS 9.8 (critical), 2021-10-07: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files…
CVE-2021-41524 - CVSS 7.5 (high), 2021-10-05: While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server.…
CVE-2021-41773 - CVSS 9.8 (critical), 2021-10-05: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files…
CVE-2021-34798 - CVSS 7.5 (high), 2021-09-16: Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-39275 - CVSS 9.8 (critical), 2021-09-16: ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but…
CVE-2021-36160 - CVSS 7.5 (high), 2021-09-16: A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server…