6917 matches found
CVE-2026-56154
A Use After Free vulnerability exists in the mod_rewrite module of the Apache HTTP Server (versions 2.4.0 through 2.4.68 ). The flaw is triggered when using lookahead functionality, specifically via the %{LA-U:HTTP:...} syntax. While the CVSS 3.1 score indicates a CRITICAL severity of 9.8 with po...
EUVD-2026-90893
Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-56153 Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-56153
Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-56153 Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-56153
The Apache HTTP Server versions 2.4.0 through 2.4.68 are vulnerable to a heap-based buffer overflow (out-of-bounds write) within the mod_charset_lite module. The flaw exists in the finish_partial_char function during character set conversions. A remote attacker can exploit this by sending special...
CVE-2026-56153
Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
EUVD-2026-90892
Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...
CVE-2026-48005 Apache HTTP Server: mod_auth_digest reauthentication attack
Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...
CVE-2026-48005 Apache HTTP Server: mod_auth_digest reauthentication attack
Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...
CVE-2026-48005
Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...
CVE-2026-48005
The Apache Software Foundation Apache HTTP Server (versions before 2.4.69 ) on all platforms is vulnerable to a denial of service (forced re-authentication) via a missing authentication check in mod_auth_digest . An unauthenticated remote client can trigger this by sending forged Authorization he...
EUVD-2026-90891
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
CVE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
CVE-2026-47360
The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability within the mod_session_cookie module. The root cause is that when the SessionCookieRemove directive changes across internal redirects, the session c...
CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
CVE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
EUVD-2026-90887
NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-46729 Apache HTTP Server: mod_heartmonitor denial of service
NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...