6638 matches found
CVE-2026-63292
A stack-based buffer overflow exists in mod_vhost_alias within the Apache Software Foundation Apache HTTP Server (versions through 2.4.68). An attacker can trigger this by sending an HTTP request with a Host header exceeding 8192 bytes, provided that VirtualDocumentRoot uses a hostname format spe...
CVE-2026-63045
The Apache HTTP Server (versions through 2.4.68 on all platforms) is vulnerable to an improper validation of FTP PASV reply addresses within the mod_proxy_ftp module. In forward proxy configurations, an untrusted FTP server can craft a malicious PASV response, forcing the proxy to open a data con...
EUVD-2026-90901
Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...
CVE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...
CVE-2026-59797 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
EUVD-2026-90900
Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-59797
Improper Privilege Management vulnerability in Apache HTTP Server's mo...
CVE-2026-59797
The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is affected by an Improper Privilege Management vulnerability in the mod_ssl component. The issue occurs via SSLRequire and file-related expressions, specifically where it allows .htaccess ap_expr file-function usage. The vulnerability has b...
EUVD-2026-90899
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-59685
The Apache HTTP Server is vulnerable to an Out-of-Bounds Write (CWE-787) on Windows systems. The flaw resides in the ap_directory_walk() function during Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM , specifically when processing paths with 8.3 names that may grow during expansion. This issue a...
CVE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
CVE-2026-58415
The Apache HTTP Server is vulnerable to an information disclosure flaw in the mod_dav_fs module (versions 2.4.0 through 2.4.68 ) on all platforms. A remote attacker can perform a GET request directly to the internal .DAV state directory to read internal state files. This allows unauthorized acces...
EUVD-2026-90897
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
CVE-2026-57941
A Use After Free vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.68 . The flaw is located within the mod_http2 component and is triggered via shared session->bbtmp re-entrancy . This vulnerability can lead to a wild write , and the security impact is rated as moderate . N...
EUVD-2026-90896
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-57941 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's modhttp2via shar...
CVE-2026-56449 Apache HTTP Server: mod_proxy_html: crash in dump_content
Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...