CVE-2026-33007

The Apache HTTP Server versions 2.4.66 and earlier are vulnerable to a NULL pointer dereference within the mod_authn_socache module. This flaw allows an unauthenticated remote user to crash a child process when the server is running in a caching forward proxy configuration . To remediate this iss...

CVE-2007-6422

CVE-2007-6422 affects Apache HTTP Server 2.2.0–2.2.6 when using a threaded MPM. The vulnerability in the mod_proxy_balancer module allows remote authenticated users to cause a denial of service by triggering a crash of the Apache child process via an invalid bb variable. This is documented in mul...

CVE-2007-4465

The CVE-2007-4465 entry covers an XSS in Apache httpd’s mod_autoindex.c (pre-2.2.6) where an undefined page charset allows injection via the P parameter using UTF-7. Impact is cross-site scripting; remediation is to upgrade Apache httpd to 2.2.6 or newer (as per the cited advisory). The descripti...

CVE-2002-0392

The Apache HTTP Server versions 1.3 through 1.3.24 and 2.0 through 2.0.36 are vulnerable to a flaw where handling invalid requests with chunk-encoded HTTP requests can cause the server to use an incorrect size. This allows remote attackers to trigger a denial of service (DoS) and potentially achi...

CVE-2007-6420

The CVE-2007-6420 issue is a CSRF vulnerability in the balancer-manager interface of Apache HTTP Server 2.2.x (mod_proxy_balancer). The vulnerability could allow remote attackers to gain privileges via unspecified vectors affecting the balancer-management UI. Connected advisories indicate multipl...

CVE-2026-42356

The Apache HTTP Server versions 2.4.60 through 2.4.68 are affected by a deployment of wrong handler vulnerability (CVE-2026-42356). This flaw allows the target of certain internal redirects originating from CGI programs to be incorrectly treated as CGI and executed. For this to occur, the target ...

CVE-2026-24072

Apache HTTP Server version 2.4.66 and earlier is affected by an escalation of privilege vulnerability in various modules, specifically including mod_rewrite and ap_expr . This flaw allows local .htaccess authors to read files with the privileges of the httpd user. Remediation is available by upgr...

CVE-2003-0542

The CVE-2003-0542 entry applies to Apache before 1.3.29, where multiple stack-based buffer overflows affect mod_alias and mod_rewrite. The root cause is a vulnerability in a regular expression with more than 9 captures, allowing an attacker to crash the server or execute arbitrary code via crafte...

CVE-2007-6421

CVE-2007-6421 is an XSS vulnerability in Apache HTTP Server 2.2.0–2.2.6 within the balancer-manager component of mod_proxy_balancer. An attacker could inject arbitrary script/HTML via the (1) ss, (2) wr, or (3) rr parameters, or via the URL. Affected product: Apache httpd 2.2.x (balancer-manager)...

CVE-2003-0020

CVE-2003-0020 concerns Apache HTTP Server: the product does not filter terminal escape sequences from error logs, enabling potential insertion of escape sequences into terminal emulators vulnerable to such sequences. Connected documents show multiple related CVEs affecting different Apache branch...

CVE-2004-1082

CVE-2004-1082 affects Apache 1.3.31 and 1.3.32 on Mac OS X Server. The vulnerability arises in mod_digest_apple where the server does not properly verify the nonce in a client response, allowing remote attackers to replay credentials. The NVD entry (CVSS v2 base score 7.5, HIGH) indicates a netwo...

CVE-2026-43951

The Apache HTTP Server versions 2.4.0 through 2.4.67 are vulnerable to an Out-of-bounds Read vulnerability involving the mod_headers and mod_mime modules when handling multiple response languages. This flaw allows an attacker to read data beyond the permitted memory range, potentially compromisin...

CVE-2026-23918

Apache HTTP Server version 2.4.66 is vulnerable to a double-free memory corruption flaw in the mod_http2 module, specifically within the h2_mplx.c stream cleanup path. This issue occurs during a race condition when an attacker sends an HTTP/2 HEADERS frame immediately followed by an RST_STREAM fr...

CVE-2026-29168

The Apache HTTP Server is vulnerable to an Allocation of Resources Without Limits or Throttling issue in the mod_md module. The root cause is related to pointer arithmetic errors when processing OCSP response data , which can allow an attacker to trigger resource exhaustion or server failures . T...

CVE-2010-1623

The CVE-2010-1623 issue affects the APR-util library (apr_brigade_split_line in buckets/apr_brigade.c) prior to version 1.3.10, where a memory leak can allow remote attackers to cause denial of service through memory consumption related to APR bucket destruction. Affected products commonly includ...

CVE-2026-59797

The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is affected by an Improper Privilege Management vulnerability in the mod_ssl component. The issue occurs via SSLRequire and file-related expressions, specifically where it allows .htaccess ap_expr file-function usage. The vulnerability has b...

CVE-2012-3502

Apache HTTP Server 2.4.x before 2.4.3 is affected by CVE-2012-3502. The vulnerability lies in the proxy components (mod_proxy_ajp.c and mod_proxy_http.c) where the server does not correctly determine when to close a back-end connection, allowing an attacker to read a response intended for a diffe...

CVE-2026-44185

The Apache HTTP Server versions 2.4.0 through 2.4.67 are vulnerable to a Buffer Over-read vulnerability. The issue occurs when the server processes outbound OCSP requests directed toward an attacker-controlled OCSP server. Exploitation of this flaw could allow a malicious actor to cause service i...

CVE-2006-4154

CVE-2006-4154 describes a format-string vulnerability in the Apache mod_tcl module (version 1.0 for Apache 2.x). The root cause is format string handling in calls to set_var (in tcl_cmds.c and tcl_core.c), allowing a remote attacker to execute arbitrary code with the httpd process privileges. Aff...

CVE-2005-3352

The CVE-2005-3352 entry documents a cross-site scripting (XSS) vulnerability in the Apache httpd mod_imap (and mod_imagemap) module. The issue arises from improper handling of the Referer header when using image maps, allowing an attacker to inject arbitrary script or HTML. Affected software is A...

CVE-2005-1268

CVE-2005-1268 is an off-by-one overflow in Apache mod_ssl CRL verification callback when using a CRL, enabling a remote attacker to cause an Apache child process crash (DoS). Several advisories note this vulnerability and document patches/upstream fixes in Apache httpd releases; e.g., Red Hat/Cen...

CVE-2003-0789

The provided documents confirm CVE-2003-0789 is an Apache mod_cgid issue where CGI redirect paths are mishandled when using a threaded MPM, potentially causing CGI output to be sent to the wrong client. This is tied to the mod_cgid component of Apache and is discussed alongside CAN-2003-0542 (buf...

CVE-2008-2168

CVE-2008-2168 : The linked SUSE/NVD entries describe a cross-site scripting (XSS) vulnerability in Apache HTTP Server up to version 2.2.6 and earlier, exploitable via UTF-7 encoded URLs that are mishandled when rendering the 403 Forbidden error page. Attacker-provided URL input can inject arbitra...

CVE-2026-44119

An Improper Privilege Management vulnerability exists in Apache HTTP Server versions 2.4.67 and earlier . This flaw allows local .htaccess authors to read files with the privileges of the httpd user . This vulnerability has been sighted in the wild. To remediate this issue, users are recommended ...

CVE-2004-0940

CVE-2004-0940 is a confirmed vulnerability: a buffer overflow in mod_include.get_tag() affects Apache 1.3.x up to 1.3.32, allowing local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error. The impact is ...

CVE-2007-3304

CVE-2007-3304 affects Apache HTTP Server (httpd) with the Prefork MPM. The issue arises when a local attacker can modify the scoreboard arrays (worker_score and process_score) to reference another process, enabling the master process to send SIGUSR1 and terminate that process, potentially causing...

CVE-2026-42528

A memory calculation bug in the mod_dav module of Apache httpd version 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to trigger a crash in server child processes. This vulnerability is characterized as a mod_dav shared lock overflow . To mitigate this issue, users a...

CVE-2001-0731

CVE-2001-0731 affects Apache 1.3.20 when Multiviews is enabled. A remote attacker can cause a directory listing to be displayed (information disclosure) by crafting a request containing an M=D query string, bypassing normal index page behavior. Public advisories and scans consistently reference t...

CVE-2004-0488

The provided documents confirm CVE-2004-0488: a stack-based buffer overflow in the ssl_util_uuencode_binary function of ssl_util.c used by Apache mod_ssl when configured to trust the issuing CA. This can allow remote code execution via a client certificate with a long subject DN. The issue affect...

CVE-2007-1743

CVE-2007-1743 affects Apache HTTP Server (httpd) with the suexec module. The issue is that suexec (in httpd 2.2.3) does not verify combinations of user and group IDs on the command line, which might allow a local user to leverage other vulnerabilities to create arbitrary UID/GID–owned files if /p...

CVE-2005-1344

CVE-2005-1344 describes a buffer overflow in Apache's htdigest (version 2.0.52) that could allow arbitrary code execution via a long realm argument. The advisory notes that htdigest is typically locally accessible and not setuid/setgid, so privilege escalation is unlikely unless htdigest is invok...

CVE-2006-4110

CVE-2006-4110 affects Apache 2.2.2 running on Windows. An information-disclosure vulnerability arises when the CGI directory is within the document root: requests that alter the case of the directory name bypass the ScriptAlias handler on a case-insensitive filesystem, allowing attackers to read ...

CVE-2004-0942

CVE-2004-0942 affects Apache 2.0.52 and earlier. A remote attacker can trigger a denial of service by sending an HTTP GET with a MIME header containing many lines of whitespace, causing CPU/memory consumption. Public references show patches and advisories across platforms (e.g., ALT Linux package...

CVE-2007-3847

CVE-2007-3847 affects Apache httpd 2.3.x (mod_proxy) where the date handling in modules/proxy/proxy_util.c under a threaded MPM can be triggered by crafted date headers, causing a buffer over-read and remote denial of service (caching forward proxy process crash). The linked advisories indicate t...

CVE-2009-1956

CVE-2009-1956: Off-by-one error in apr_brigade_vprintf in Apache APR-util before 1.3.5 on big-endian platforms. Remote attackers could obtain sensitive information or cause a denial of service (application crash) via crafted input. Affected product: APR-util (pre-1.3.5) used with APR/httpd; impac...

CVE-2008-0005

CVE-2008-0005 affects Apache httpd mod_proxy_ftp: versions prior to 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev do not define a charset, enabling remote XSS via UTF-7 encoding. Remediation per connected advisories: upgrade to patched Apache httpd versions that backport fixes f...

CVE-2015-0253

CVE-2015-0253 affects the Apache HTTP Server 2.4.12. The vulnerability arises in the read_request_line function within server/protocol.c, where the protocol structure member is not initialized. This can enable a remote attacker to trigger a denial-of-service via a NULL pointer dereference and cra...

CVE-2009-0023

CVE-2009-0023 affects Apache APR-util prior to 1.3.5. The vulnerability in apr_strmatch_precompile (strmatch/apr_strmatch.c) can be exploited by crafted input via that library’s usage contexts (e.g., .htaccess with Apache HTTP Server, SVNMasterURI in mod_dav_svn, mod_apreq2, or applications using...

CVE-2007-1742

Apache HTTP Server (httpd) 2.2.3’s suexec uses a partial path comparison to determine if the current directory is within the document root. This may allow local users to operate on incorrect directories under an html directory (e.g., html_backup/htmleditor). The issue is described across multiple...

CVE-2004-0885

The CVE-2004-0885 entry describes a vulnerability in Apache's mod_ssl for versions 2.0.35–2.0.52 where, when using SSLCipherSuite in directory or location context, remote clients can bypass intended restrictions by selecting any cipher suite allowed by the virtual host configuration. The initial ...

CVE-2026-63292

A stack-based buffer overflow exists in mod_vhost_alias within the Apache Software Foundation Apache HTTP Server (versions through 2.4.68). An attacker can trigger this by sending an HTTP request with a Host header exceeding 8192 bytes, provided that VirtualDocumentRoot uses a hostname format spe...

CVE-2002-0840

CVE-2002-0840 is a cross-site scripting (XSS) vulnerability in the default error page of Apache. It affects Apache 2.0 before 2.0.43 and 1.3.x up to 1.3.26, when UseCanonicalName is set to off and wildcard DNS is supported. An attacker can inject script via the Host header to execute in other vis...

CVE-2026-29169

A NULL pointer dereference vulnerability exists in the mod_dav_lock module of the Apache HTTP Server (version 2.4.66 and earlier). A remote attacker can exploit this by sending a malicious request to trigger a denial-of-service (DoS) attack, causing the server to crash. Notably, mod_dav_lock is n...

CVE-2003-0993

CVE-2003-0993 concerns Apache 1.3.x mod_access on big-endian 64-bit systems. The issue arises because Allow/Deny rules that specify IP addresses without a netmask are not parsed correctly, potentially allowing remote attackers to bypass access restrictions. Multiple OpenVAS entries and vendor adv...

CVE-2025-3891

CVE-2025-3891 affects the Apache httpd mod_auth_openidc module. A remote, unauthenticated attacker can cause a DoS by sending an empty POST when the OIDCPreservePost directive is enabled, crashing the server and impacting availability. Evidence from multiple advisories confirms the issue and ment...

CVE-2003-0245

CVE-2003-0245 concerns a vulnerability in the APR library (apr_psprintf) used by Apache 2.0.x, reported for versions 2.0.37–2.0.45. The flaw can crash the server and, in some cases, enable arbitrary code execution when triggered by long strings (notably via mod_dav) and potentially other vectors....

CVE-2010-0010

The CVE-2010-0010 issue affects Apache HTTP Server’s mod_proxy (proxy_util.c) on 64-bit platforms. The root cause is an integer overflow in the ap_proxy_send_fb function when handling large chunk sizes, which can trigger a heap-based buffer overflow. This condition enables a remote origin server ...

CVE-2005-2728

Apache httpd is affected by CVE-2005-2728 due to a flaw in the byte-range filter that can cause memory exhaustion and denial of service when handling HTTP requests with a large Range header, as described in multiple connected advisories. The issue affects Apache httpd 2.0.x before 2.0.54 (and var...

CVE-2002-0061

Apache HTTP Server on Windows (Win32) is vulnerable prior to versions 1.3.24 and 2.0.x prior to 2.0.34-beta. The flaw allows remote attackers to execute arbitrary commands by sending shell metacharacters (a pipe |) as arguments to batch (.bat) or .cmd scripts, which reach the shell interpreter (c...

CVE-2026-57941

A Use After Free vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.68 . The flaw is located within the mod_http2 component and is triggered via shared session->bbtmp re-entrancy . This vulnerability can lead to a wild write , and the security impact is rated as moderate . N...