Http Server (Oracle) - vulnerabilities (CVEs)

116 CVEs, 4 in the last 30 days, 43 known versions, newest CVE from 2026-10-20. Vendor: Oracle.

CVEs of Http Server

CVE-2026-91473 - CVSS 7.8 (high), 2026-10-20: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0.…
CVE-2026-91419 - CVSS 7.8 (high), 2026-10-20: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported version that is affected is 12.2.1.4.0.…
CVE-2026-87347 - CVSS 9.6 (critical), 2026-10-20: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 12.2.1.4.0 and…
CVE-2026-87346 - CVSS 8.7 (high), 2026-10-20: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).…
CVE-2026-60530 - CVSS 7.8 (high), 2026-07-21: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0.…
CVE-2026-60454 - CVSS 7.8 (high), 2026-07-21: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and…
CVE-2026-60438 - CVSS 9.1 (critical), 2026-07-21: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and…
CVE-2026-60431 - CVSS 8.6 (high), 2026-07-21: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and…
CVE-2026-60365 - CVSS 10 (critical), 2026-07-21: Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web…
CVE-2026-60364 - CVSS 9.8 (critical), 2026-07-21: Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web…
CVE-2026-60363 - CVSS 9.8 (critical), 2026-07-21: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0…
CVE-2026-34291 - CVSS 8.7 (high), 2026-04-21: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and…
CVE-2026-21962 - CVSS 10 (critical), 2026-01-20: Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in…
CVE-2025-21498 - CVSS 5.3 (medium), 2025-01-21: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily…
CVE-2024-20991 - CVSS 5.3 (medium), 2024-04-16: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0.…
CVE-2023-22019 - CVSS 7.5 (high), 2023-10-17: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0.…
CVE-2022-21593 - CVSS 7.1 (high), 2022-10-18: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). Supported versions that are affected are…
CVE-2020-29508 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation…
CVE-2020-35166 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy…
CVE-2020-35169 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation…
CVE-2020-29507 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, contain an Improper Input Validation…
CVE-2020-35164 - CVSS 8.1 (high), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy…
CVE-2020-35168 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy…
CVE-2020-29506 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy…
CVE-2020-35163 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random…
CVE-2020-35167 - CVSS 9.8 (critical), 2022-07-11: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy…
CVE-2020-26185 - CVSS 7.5 (high), 2022-06-01: Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability.
CVE-2020-26184 - CVSS 7.5 (high), 2022-06-01: Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability.
CVE-2022-22720 - CVSS 9.8 (critical), 2022-03-14: Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP…
CVE-2022-22719 - CVSS 7.5 (high), 2022-03-14: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52…
CVE-2022-23943 - CVSS 9.8 (critical), 2022-03-14: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This…
CVE-2022-22721 - CVSS 9.1 (critical), 2022-03-14: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out…
CVE-2022-21716 - CVSS 7.5 (high), 2022-03-03: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to…
CVE-2022-25315 - CVSS 9.8 (critical), 2022-02-18: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25314 - CVSS 7.5 (high), 2022-02-18: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-25313 - CVSS 6.5 (medium), 2022-02-18: In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
CVE-2022-25236 - CVSS 9.8 (critical), 2022-02-16: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVE-2022-25235 - CVSS 9.8 (critical), 2022-02-16: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain…
CVE-2022-0391 - CVSS 7.5 (high), 2022-02-09: A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The…
CVE-2021-4034 - CVSS 7.8 (high), 2022-01-28: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users…
CVE-2022-21375 - CVSS 5.5 (medium), 2022-01-19: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable…
CVE-2022-21271 - CVSS 5.3 (medium), 2022-01-19: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected…
CVE-2021-4185 - CVSS 7.5 (high), 2021-12-30: Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-4181 - CVSS 7.5 (high), 2021-12-30: Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-4184 - CVSS 7.5 (high), 2021-12-30: Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-4183 - CVSS 5.5 (medium), 2021-12-30: Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file
CVE-2021-4182 - CVSS 7.5 (high), 2021-12-30: Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-44790 - CVSS 9.8 (critical), 2021-12-20: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is…
CVE-2021-44224 - CVSS 8.2 (high), 2021-12-20: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing…
CVE-2021-43818 - CVSS 8.2 (high), 2021-12-13: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script…
CVE-2021-42717 - CVSS 7.5 (high), 2021-12-07: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web…
CVE-2021-25219 - CVSS 5.3 (medium), 2021-10-27: In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as…
CVE-2021-35666 - CVSS 5.9 (medium), 2021-10-20: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported version that is affected is 11.1.1.9.0.…
CVE-2021-2480 - CVSS 3.7 (low), 2021-10-20: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 11.1.1.9.0.…
CVE-2021-41617 - CVSS 7 (high), 2021-09-26: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not…
CVE-2021-34798 - CVSS 7.5 (high), 2021-09-16: Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-39275 - CVSS 9.8 (critical), 2021-09-16: ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but…
CVE-2021-36160 - CVSS 7.5 (high), 2021-09-16: A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server…
CVE-2021-35940 - CVSS 7.1 (high), 2021-08-23: An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue…
CVE-2021-2315 - CVSS 5.4 (medium), 2021-04-22: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versions that are affected are 11.1.1.9.0,…
CVE-2020-5360 - CVSS 7.5 (high), 2020-12-16: Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. An unauthenticated remote attacker could…
CVE-2020-1971 - CVSS 5.9 (medium), 2020-12-08: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a…
CVE-2020-24977 - CVSS 6.5 (medium), 2020-09-04: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in…
CVE-2020-1967 - CVSS 7.5 (high), 2020-04-21: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a…
CVE-2020-2952 - CVSS 6.5 (medium), 2020-04-15: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 11.1.1.9.0.…
CVE-2020-2545 - CVSS 5.3 (medium), 2020-01-15: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 11.1.1.9.0,…
CVE-2020-2530 - CVSS 6.1 (medium), 2020-01-15: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versions that are affected are 11.1.1.9.0,…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-10097 - CVSS 7.2 (high), 2019-09-26: In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially…
CVE-2019-10082 - CVSS 9.1 (critical), 2019-09-26: In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection…
CVE-2019-5482 - CVSS 9.8 (critical), 2019-09-16: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-2751 - CVSS 5.9 (medium), 2019-07-23: Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OHS Config MBeans). Supported versions that are affected are…
CVE-2019-5443 - CVSS 7.8 (high), 2019-07-02: A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1…
CVE-2018-20843 - CVSS 7.5 (high), 2019-06-24: In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM…
CVE-2019-0197 - CVSS 4.2 (medium), 2019-06-11: A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host,…
CVE-2019-0211 - CVSS 7.8 (high), 2019-04-08: In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads…
CVE-2019-0217 - CVSS 7.5 (high), 2019-04-08: In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid…
CVE-2019-3823 - CVSS 7.5 (high), 2019-02-06: libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer…
CVE-2019-3822 - CVSS 9.8 (critical), 2019-02-06: libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header…
CVE-2018-16890 - CVSS 7.5 (high), 2019-02-06: libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages…
CVE-2019-2414 - CVSS 7.8 (high), 2019-01-16: Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). The supported version that is affected is…
CVE-2018-2760 - CVSS 5.9 (medium), 2018-04-19: Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module). Supported versions that are affected are 12.1.3 and…
CVE-2018-2561 - CVSS 5.3 (medium), 2018-01-18: Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are…
CVE-2016-3482 - CVSS 3.7 (low), 2016-07-21: Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 and 12.1.3.0 allows remote attackers to affect…
CVE-2016-0671 - CVSS 3.7 (low), 2016-04-21: Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via…
CVE-2015-3195 - CVSS 5.3 (medium), 2015-12-06: The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e…
CVE-2015-2808 - CVSS 3.7 (low), 2015-04-01: The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which…
CVE-2014-0226 - CVSS 6.8 (medium), 2014-07-20: Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer…
CVE-2013-5704 - CVSS 5 (medium), 2014-04-15: The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer…
CVE-2014-0098 - CVSS 5 (medium), 2014-03-18: The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of…
CVE-2013-6438 - CVSS 5 (medium), 2014-03-18: The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from…
CVE-2013-1862 - CVSS 5.1 (medium), 2013-06-10: mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters,…
CVE-2013-2566 - CVSS 5.9 (medium), 2013-03-15: The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct…
CVE-2012-2751 - CVSS 4.3 (medium), 2012-07-22: ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the…
CVE-2010-0425 - CVSS 10 (critical), 2010-03-05: modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on…
CVE-2009-1955 - CVSS 7.5 (high), 2009-06-08: The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache…
CVE-2007-5000 - CVSS 4.3 (medium), 2007-12-13: Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2)…
CVE-2007-0280 - CVSS 7.5 (high), 2007-01-17: Unspecified vulnerability in Oracle HTTP Server 9.0.1.5, Application Server 9.0.4.3, 10.1.2.0.0, 10.1.2.0.2, and 10.1.2.2; and Collaboration Suite 9.0.4.2 and…
CVE-2007-0279 - CVSS 7.5 (high), 2007-01-17: Multiple unspecified vulnerabilities in Oracle HTTP Server 9.2.0.8 and Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack…