BIT-APACHE-2026-79768 Apache HTTP Server: mod_userdir information disclosure

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

BIT-APACHE-2026-73637 Apache HTTP Server: mod_auth_digest DoS attack

Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifeti...

BIT-APACHE-2026-73636 Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...

BIT-APACHE-2026-63686 Apache HTTP Server: mod_xml2enc crash on charset conversion failure

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...

BIT-APACHE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

BIT-APACHE-2026-59797 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

BIT-APACHE-2026-57941 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-56449 Apache HTTP Server: mod_proxy_html: crash in dump_content

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-56154 Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead %LA-U:HTTP:... This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2021-42013

CVE-2021-42013 — PoC : Path Traversal + RCE via modcgi contournement du correctif À utiliser uniquement dans des environnements contrôlés et personnels. Ne pas utiliser contre des systèmes sans autorisation. Description PoC développée pour démontrer CVE-2021-42013 , présente dans Apache HTTP Serv...

CVE-2021-41773

CVE-2021-41773 — PoC : Traversée de chemin + RCE via modcgi Réservé à une utilisation dans des environnements contrôlés et personnels. Ne pas utiliser contre des systèmes sans autorisation. Description PoC développée pour démontrer et comprendre la vulnérabilité CVE-2021-41773 , présente dans...

CVE-2021-41773-Apache-Lab

CVE-2021-41773 — Laboratoire Apache HTTP Server 2.4.49 Reproduction de CVE-2021-41773 , une vulnérabilité de traversée de chemin dans Apache HTTP Server 2.4.49. Ce projet utilise Docker pour créer un environnement vulnérable isolé et un PoC Python pour démontrer la divulgation contrôlée de...

CVE-2021-41773-PoC

CVE-2021-41773 ثغرة اجتياز المسار وكشف الملفات في خادم Apache HTTP Server 2.4.49 يختبر هذا البرنامج النصي خادم Apache HTTP Server 2.4.49 الاستخدام: CVE-2021-41773.py الخيارات لعنوان IP واحد فقط: python CVE-2021-41773.py IPaddress الخيار -f لقائمة IP في ملف مثال: python CVE-2021-41773.py -f...

httpd-2.4.49

httpd-2.4.49 حرج: اجتياز المسار وتنفيذ التعليمات البرمجية عن بُعد في Apache HTTP Server 2.4.49 و2.4.50 إصلاح غير مكتمل لـ CVE-2021-41773 CVE-2021-42013...

LayarKacaSiber-CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 كيفية تشغيل مختبر CVE-2021-41773-Path Traversal 1. قم بتثبيت وتشغيل Docker على جهاز الكمبيوتر/اللابتوب الخاص بك 2. استنساخ هذا المستودع من GitHub 3. انتقل إلى مجلد Path Traversal 4. أدخل الأوامر التالية docker build -t cve-2021-41773-path-traversal . و...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main : les revendications JWT iss/aud non validées Reproducteur de preuve de concept exécutable pour la vulnérabilité Apache Camel où le serveur HTTP embarqué de camel-main construit son authentificateur JWT uniquement à partir d'un keystore lorsqu'aucun...

CVE-2026-49975

CVE-2026-49975 قنبلة HTTP/2 ★ CVE-2026-49975 قنبلة HTTP/2 إثبات المفهوم ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 نظرة عامة CVE-2026-49975 هي ثغرة رفض الخدمة DoS في خادم Apache HTTP. تظهر الثغرة في مسار معالجة طلبات HTTP/2، حيث يمكن دمج عدة حقول ترويسة cook...