httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...

Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow

A flaw was found in modproxyajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP Apache JServ Protocol server, to send a specially crafted message. This message can cause modproxyajp to write attacker-controlled data...

cve-2021-41773

CVE-2021-41773 – Apache 路径遍历报告 摘要 Apache HTTP Server 2.4.49 版本中发现的漏洞，根据 Web 服务器配置，可通过路径遍历攻击暴露系统敏感文件 路径遍历：攻击者可通过包含 ../ 的路径访问 Web 根目录之外的文件 信息 漏洞名称 ：CVE-2021-41773 受影响版本 ：Apache HTTP Server 2.4.49 漏洞类型 ：路径遍历 官方补丁情况 ：已在 2.4.50 及以上版本修补 实验环境配置 基础镜像：httpd:2.4.49（DockerHub） 容器运行方式：Dockerfile +...

CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 运行CVE-2021-41773-Path Traversal实验室的步骤 1. 在您的PC/笔记本电脑上安装并运行Docker 2. 克隆此GitHub仓库 3. 进入Path Traversal文件夹 4. 输入以下命令 docker build -t cve-2021-41773-path-traversal . 和 docker run --rm -dit -p 8888:80 cve-2021-41773-path-traversal 5. 通过浏览器访问...

RHEL 9 : httpd (RHSA-2026:67152)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67152 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

Preproduce-CVE-2021-41773

Preproduce CVE 2021-41773 Apache HTTP Server 2.4.49 におけるパストラバーサルおよびファイル開示の脆弱性 CVE-2021-41773 POC root@kitploit: $ docker compose up 動作確認 root@kitploit: $ curl -I http://localhost HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 13:25:18 GMT Server: Apache/2.4.49 Unix Last-Modified: Mon, 11 Jun 2007 18:53:1...

CVE-2026-42536-PoC

CVE-2026-42536：Apache HTTP Server modxml2enc 堆溢出 PoC 此 PoC 代码是博客文章 https://erberkan.github.io/2026/PatchDiffingandN-DayDefense/ 的一部分。 本仓库包含 CVE-2026-42536 的受控概念验证，这是 Apache HTTP Server 的 modxml2enc 模块中基于堆的越界写入漏洞。Apache HTTP Server 2.4.0 至 2.4.67 版本受影响；2.4.68 版本包含上游修复。 所演示的结果是内存损坏，随后导致 Apache...

CVE-2021-41773-RedTeam

CVE-2021-41773 — Apache HTTP Server 2.4.49 路径遍历 / RCE ITSOLERA 网络安全部门 — 红队任务 3 团队: Offensive Team Zeta 日期: 2026年3月18日 ⚠️ 免责声明 本仓库仅用于教育目的 。 所有测试均在隔离的本地 Docker 实验环境 中执行。 切勿用于在线、生产或第三方系统。 CVE 摘要 字段| 详情 ---|--- CVE ID| CVE-2021-41773 CVSS| 9.8 严重 受影响版本| 仅 Apache HTTP Server 2.4.49 类型| 路径遍历 + 远程代码执行...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003828)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003828 advisory. A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2023-003823)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003823 advisory. Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the modisapi module. Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003824)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003824 advisory. Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to th...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003819)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003819 advisory. Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This ma...

USN-8571-2: Apache HTTP Server regression

USN-8571-1 fixed vulnerabilities in Apache HTTP Server. That fix was incomplete due to a missing library symbol, resulting in a regression that could cause Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. This update fixes the problem. We apologize for the inconvenience...

Important: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers

A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie directives. This could lead to a denial of service DoS condition, making the server unavailable to legitimate users...

httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...