httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

httpd: httpd: arbitrary code execution via incorrect handler assignment during internal CGI redirects

A flaw was found in Apache HTTP Server. An attacker could achieve unintended code execution when an internal redirect generated by a Common Gateway Interface CGI program points to a non-executable file. If the target file resides in a directory configured for CGI execution and lacks a file...

-CVE-2021-44790

CVE-2021-44790 Description of CVE-2021-44790 CVE-2021-44790 describes a system-level security vulnerability in the modlua of the Apache HTTP Server, specifically in version 2.4.51 and earlier versions. This vulnerability is triggered when the r:parsebody function improperly handles HTTP...

CVE-2026-47360

A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...

CVE-2026-56449

A flaw was found in the modproxyhtml module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service DoS. Mitigation...

CVE-2026-48005

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

CVE-2026-42356

A flaw was found in Apache HTTP Server. An attacker could achieve unintended code execution when an internal redirect generated by a Common Gateway Interface CGI program points to a non-executable file. If the target file resides in a directory configured for CGI execution and lacks a file...

Sonicwall - Pre-Authentication Arbitrary File Read

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. id: CVE-2019-10098 info: name: Apache HTTP server v2.4.0 to v2.4.39 - Open...

CVE-2021-41773

CVE-2021-41773 уязвимость в apache http server работает только в 2.4.49 настройки требований httpd.conf ... LoadModule cgimodule modules/modcgi.so раскомментируйте эту строку ... AllowOverride none Require all denied закомментируйте эту строку или установите Require all granted ... Ссылки...

CVE-2026-58415

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

CVE-2026-42528

A flaw was found in the moddav module of the Apache HTTP Server. This vulnerability allows a Denial of Service DoS by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning WebDAV locks can trigger a memory calculation error during lock...

CVE-2026-63718

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2026-73636

A flaw was found in the modauthdigest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce a single-use security token lifetime of...

CVE-2026-63686

A flaw was found in the modxml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service DoS by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access nu...

CVE-2026-46729

A flaw was found in the modheartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attack...

CVE-2026-79768

A flaw was found in Apache HTTP Server's moduserdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory '/./' path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP...

Linux Distros Unpatched Vulnerability : CVE-2026-56154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead %LA-U:HTTP:... This issue affects Apache HTTP Server: from 2.4.0 through...

Apache HTTP Server 2.4.68 mod_vhost_alias Stack Overflow

Apache HTTP Server versions through 2.4.68 contain a stack-based buffer overflow in modvhostalias when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. The supplied tool performs a non-intrusive version check using the Server header...

Linux Distros Unpatched Vulnerability : CVE-2026-59685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache...