Cherokee HTTPD <=0.5 - Cross-Site Scripting

Cherokee HTTPD 0.5 and earlier contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. id: CVE-2006-1681 info:...

Apache httpd <=2.4.29 - Arbitrary File Upload

Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in , which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of...

CVE-2021-41773

CVE-2021-41773 Apache httpd only 2.4.49 For educational purposes only. See Reference for the details. Run $ git clone https://github.com/masahiro331/CVE-2021-41773.git $ cd CVE-2021-41773 $ docker build -t cve-2021-41773 . $ docker run -d -p 8080:80 cve-2021-41773 Exploit This vulnerability affec...

RockyLinux 10 : httpd (RLSA-2026:89860)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89860 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via intege...

CVE-2021-26690---Apache-mod_session

Patch diffing for CVE-2021-26690 - Apache modsession This vulnerability is a NULL pointer dereference within the modsession Apache's module. It will cause a denial of service for the child processes of Apache's httpd. By using a repetitive loop, each Apache workers will crash, leading to a denial...

R7000_httpd_BOF_CVE-2020-15416

R7000httpdBOFCVE-2020-15416 I demenstrated you on how to set up a debugging environment using QEMU user mode for Netgear R7000 wifi router. Then I provide a walkthrough of an Exploit of Netgear WiFi Router httpd Buffer Overflow VulnerabilityCVE-2020-15416. It refers to...

Important: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite

A flaw was found in httpd's modcharsetlite module. A heap-based buffer overflow an out-of-bounds memory write occurs in the finishpartialchar function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias

A flaw was found in httpd's modvhostalias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause...

httpd: httpd: Authentication state corruption via concurrent Digest authentication requests

A flaw was found in httpd's modauthdigest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce...

httpd: httpd: Denial of Service via integer overflow in mod_dav_fs

A flaw was found in httpd. An integer overflow in the moddavfs module occurs when processing Web Distributed Authoring and Versioning WebDAV PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash...

Apache Tomcat JK Connect <=1.2.44 - Manager Access

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

XiongMai uc-httpd 1.0.0 - Buffer Overflow

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. id: CVE-2018-10088 info: name: XiongMai uc-httpd 1.0.0 - Buffer Overflow author: 0xAkoko severity: critical description: | Buffer overflow in XiongMai uc-httpd 1.0....

ALSA-2026:89860 Important: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...

httpd security update

2.4.63-13.0.1.el102.8 - Replace index.html with Oracle's index page oracleindex.html. 2.4.63-13.8 - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280355 - httpd: Denial of Service via modrewrite lookahead...

RHEL 10 : httpd (RHSA-2026:89860)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89860 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP...

Oracle Linux 10 : httpd (ELSA-2026-89860)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89860 advisory. - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280355 - httpd:...

MiracleLinux 9 : httpd-2.4.62-13.el9_8.9 (AXSA:2026-2145:11)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2145:11 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88229)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688229 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer...