CVE-2026-63045

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

EUVD-2026-90901

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045

The Apache HTTP Server (versions through 2.4.68 ) is vulnerable to an improper validation of the FTP PASV reply address within the mod_proxy_ftp module. When configured as a forward proxy, an untrusted FTP server can provide a crafted PASV response, forcing the proxy to establish a data connectio...

CVE-2026-59797

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59797

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59797 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59797

The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is affected by an Improper Privilege Management vulnerability in the mod_ssl component. The issue occurs via SSLRequire and file-related expressions, specifically where it allows .htaccess ap_expr file-function usage. The vulnerability has b...

EUVD-2026-90900

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59797 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59797

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59685

Apache HTTP Server (versions 2.4.0 through 2.4.68 ) contains an Out-of-bounds Write vulnerability when deployed on Windows environments. The flaw occurs in the ap_directory_walk() function during Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM while processing paths with 8.3 names that expand bey...

CVE-2026-59685

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59685

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

EUVD-2026-90899

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-58415

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...