7405 matches found
CVE-2026-73636
The Apache HTTP Server 2.4.x on all platforms is vulnerable to an authentication bypass via a capture-replay attack in the mod_auth_digest module. When AuthDigestNonceLifetime is set to 0 , a man-in-the-middle (MITM) attacker can replay captured digest authentication credentials by sending crafte...
CVE-2026-73636 Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...
CVE-2026-73636
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...
EUVD-2026-90907
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...
CVE-2026-73636
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...
CVE-2026-73636 Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...
CVE-2026-46729
NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
DEBIAN-CVE-2026-46729
NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
DEBIAN-CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
ALPINE-CVE-2026-46729
NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
ALPINE-CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
AZL-106767 CVE-2026-47360 affecting package httpd 2.4.68-1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
AZL-106788 CVE-2026-46729 affecting package httpd 2.4.68-1
NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-42356
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...
ALPINE-CVE-2026-42356
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...
DEBIAN-CVE-2026-42356
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...
AZL-106752 CVE-2026-42356 affecting package httpd 2.4.68-1
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...
CVE-2026-63718
Apache HTTP Server (versions 2.4.30 through 2.4.68 ) is vulnerable to an HTTP response smuggling vulnerability in the mod_proxy_uwsgi module. This issue occurs when the server processes a crafted uWSGI response containing a Transfer-Encoding header, allowing a remote attacker to desynchronize HTT...
CVE-2026-63718 Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...