CVE-2011-1928

The CVE-2011-1928 issue affects the APR library’s fnmatch implementation (apr_fnmatch.c) in APR 1.4.3/1.4.4 and Apache HTTP Server 2.2.18, causing an infinite-loop DoS when processing certain URIs due to an incorrect fix for CVE-2011-0419. Connected advisories note the problem is triggered by wil...

CVE-2003-0132

CVE-2003-0132: Apache 2.0 up to 2.0.44 is vulnerable to a memory-leak DoS via large sequences of linefeed characters. The issue arises because Apache may allocate memory (about 80 bytes per linefeed), enabling remote denial-of-service. OpenVAS entries summarize the vulnerability as a linefeed mem...

CVE-2026-48913

This CVE (CVE-2026-48913) concerns Apache HTTP Server’s mod_http2 component. The reported issue is a Use After Free vulnerability when file handles are exhausted, affecting Apache HTTP Server versions 2.4.55–2.4.67. The description and connected sources consistently cite memory- or resource-relat...

CVE-2002-0839

CVE-2002-0839 affects Apache 1.3.x prior to 1.3.27. The vulnerability stems from the shared memory scoreboard in the HTTP daemon, where a user running as the Apache UID can modify parent[].pid and parent[].last_rtime, enabling the process to receive a SIGUSR1 signal with potential root-level effe...

CVE-2002-2029

CVE-2002-2029 affects PHP on Windows with Apache when ScriptAlias /php/ is set to c:/php/. A remote attacker can read arbitrary files and potentially execute arbitrary programs by requesting php.exe with a filename in the query string. Root cause is a configuration vulnerability enabling direct e...

CVE-2004-0747

CVE-2004-0747 describes a local buffer overflow in Apache HTTP Server versions 2.0.50 and earlier, triggered by expansion of environment variables in .htaccess or server configuration files. The underlying issue involves copying environment data into a fixed-size buffer (ap_resolve_env) via strin...

CVE-1999-0067

CVE-1999-0067 affects the phf CGI program that is included with NCSA httpd-derived web servers. The vulnerability allows remote command execution by supplying shell metacharacters in input processed by the phf CGI script, due to inadequate input sanitization. The issue can execute commands with t...

CVE-2001-0131

CVE-2001-0131 is linked in Debian/OpenVAS advisories (e.g., DSA 021-1/188, OpenVAS entries) and references Apache components, but the connected documents do not provide detailed technical description of the root cause or explicit fixes beyond noting the vulnerability and CVSS scores. The Debian/O...

CVE-2002-0843

CVE-2002-0843 affects Apache httpd’s ApacheBench benchmark tool (ab.c). The description specifies buffer overflows in ab.c that occur in Apache before 1.3.27 and in Apache 2.x before 2.0.43. A malicious web server can trigger a long response to cause a denial of service and potentially execute ar...

CVE-2003-0192

CVE-2003-0192 describes an issue in Apache 2.x before 2.0.47 (and mod_ssl for Apache 1.3) where certain sequences of per-directory renegotiations combined with using SSLCipherSuite to upgrade a weak cipher could cause the server to continue using a weak cipher. The connected advisories confirm af...

CVE-2004-0942

CVE-2004-0942 affects Apache 2.0.52 and earlier. A remote attacker can trigger a denial of service by sending an HTTP GET with a MIME header containing many lines of whitespace, causing CPU/memory consumption. Public references show patches and advisories across platforms (e.g., ALT Linux package...

CVE-2004-0493

The CVE-2004-0493 entry relates to Apache httpd 2.0.x prior to 2.0.50, where long MIME header lines with excessive spaces/tabs can cause memory exhaustion and, on 64-bit systems, a potential heap-based buffer overflow. Connected advisories confirm DoS concerns across Apache 2.0.x and related modu...

CVE-2005-2970

CVE-2005-2970 is described across multiple advisories as a memory-leak vulnerability in the Apache httpd worker MPM (worker.c). In affected setups, memory consumed by aborted connections could not be freed for new requests, enabling a remote attacker to trigger a Denial of Service via memory exha...

CVE-1999-0289

The CVE-1999-0289 entry concerns the Apache HTTP Server for Win32. Affected component: the Web server handling URLs; issue described as: the server may provide access to restricted files when a "." is appended to a requested URL. The core impact is restricted-file disclosure. Public details acros...

CVE-2007-6514

CVE-2007-6514 affects Apache HTTP Server when run on Linux with a document root on a Windows SMB share mounted via smbfs. The vulnerability arises from a trailing backslash () not being handled by the AddType directive, allowing remote attackers to disclose unprocessed contents of PHP files (e.g....

CVE-2007-1863

CVE-2007-1863 affects the Apache HTTP Server, specifically the mod_cache module. When caching is enabled and using a threaded MPM, a crafted request containing one of the Cache-Control headers (s-maxage, max-age, min-fresh, or max-stale) without a value can crash the Apache child process, causing...

CVE-2000-0505

The CVE-2000-0505 entry concerns the Apache HTTP Server on Windows (Win32) in the 1.3.x line. The vulnerability allows remote attackers to list directory contents by issuing a URL containing a large sequence of forward slashes, which triggers directory listing of the web root as configured in htt...

CVE-2004-0174

CVE-2004-0174 affects Apache HTTP Server via a denial-of-service condition caused by handling multiple listening sockets. OpenVAS entries describe the vulnerability as applicable to Apache versions older than 2.0.49 or 1.3.31, where a remote attacker can block new connections by targeting a rarel...

CVE-2009-1191

CVE-2009-1191 affects the Apache HTTP Server, specifically the mod_proxy_ajp component in 2.2.11. The issue allows a remote attacker to obtain sensitive response data intended for a client that sent an earlier POST request with no request body, via a crafted HTTP request. Connected advisories not...

CVE-2001-0925

The CVE-2001-0925 entry describes a vulnerability in the default installation of Apache prior to 1.3.19 where a crafted HTTP request containing many slashes can cause directory listings (instead of the multiview index) due to mishandling by mod_negotiation, mod_dir, or mod_autoindex. Affected sof...

CVE-2002-0654

CVE-2002-0654 affects Apache HTTP Server 2.0.x (up to 2.0.39) on Windows, OS/2 and NetWare. The vulnerability allows remote attackers to disclose the server’s full path by triggering errors from (1) a request for a .var file or (2) a failure when invoking a CGI child process, causing error messag...

CVE-2004-0809

CVE-2004-0809 affects the Apache mod_dav WebDAV module in Apache 2.0.50 and earlier, allowing remote attackers to cause a denial of service (child process crash) via a particular sequence of LOCK requests for locations with WebDAV access. Connected documents in OpenVAS/Tenable references corrobor...

CVE-2001-1534

CVE-2001-1534 affects Apache with the mod_usertrack module (versions 1.3.11–1.3.20). The vulnerability arises from generating session IDs with predictable information (host IP, system time, server PID), enabling local users to obtain session IDs and bypass authentication when those IDs are used f...

CVE-2003-0016

CVE-2003-0016 refers to the Apache HTTP Server vulnerability where, on Windows 9x/Me, an HTTP request containing MS-DOS device names could remotely cause a denial of service or enable arbitrary code execution. Public sources in the connected documents consistently describe this as a flaw in filte...

CVE-1999-0045

CVE-1999-0045 concerns an information-disclosure flaw in the nph-test-cgi script used by some web servers, where an unauthenticated attacker can list directory contents. The Nessus plugin (NCDSA HTTPd nph-test-cgi Arbitrary Directory Listing) explains that the issue arises because the script does...

CVE-2004-1834

The CVE-2004-1834 issue affects mod_disk_cache in Apache 2.0–2.0.49, which stores client headers (including authentication information) on disk, potentially allowing local users to access sensitive data. The provided documents confirm the vulnerability description but do not specify a concrete fi...

CVE-2002-0661

Apache HTTP Server 2.0.x up to 2.0.39 on Windows/OS2/Netware is affected by CVE-2002-0661 through a directory traversal flaw. An attacker can use backslash-embedded ... sequences to read arbitrary files and, per sources, potentially execute commands via the vulnerable path. The issue is fixed in ...

CVE-2004-0113

CVE-2004-0113 affects Apache httpd with mod_ssl on Apache 2 before 2.0.49. A memory leak in ssl_engine_io.c can be triggered by plain HTTP requests to the SSL port, leading to denial of service via memory consumption. Affected product is Apache HTTP Server with mod_ssl; root cause is a leak in SS...

CVE-2004-0811

Technical details about CVE-2004-0811 are not publicly available in the provided connected documents. Please monitor for updates for affected products, exact vectors, impact, and remediation information.

CVE-1999-1053

CVE-1999-1053 relates to the guestbook.pl CGI which sanitizes Server-Side Includes by stripping text between . The provided data confirms a vulnerability where this sanitization is incomplete, allowing remote attackers to execute arbitrary commands when guestbook.pl runs on Apache 1.3.9 and poten...

CVE-2026-29169

CVE-2026-29169 : A NULL pointer dereference in mod_dav_lock of Apache HTTP Server 2.4.66 and earlier can crash the server when handling a malicious request. mod_dav_lock is not used internally by mod_dav or mod_dav_fs; the only known use-case was with mod_dav_svn from Apache Subversion (earlier t...

CVE-2000-0869

CVE-2000-0869: The default Apache 1.3.12 configuration on SuSE Linux 6.4 enables WebDAV, allowing remote attackers to list arbitrary directories via the PROPFIND method. This results in information disclosure about directory structure. The issue is tied to the WebDAV module being active by defaul...

CVE-2003-1307

Summary: CVE-2003-1307 affects the mod_php module of the Apache HTTP Server. Vulnerability: Local users with write access to PHP scripts can signal the server’s process group and manipulate server file descriptors, demonstrated by sending a STOP signal and intercepting connections on the server’s...

CVE-1999-0071

CVE-1999-0071 affects the Apache httpd server prior to 1.1.2 (versions 1.1.1 and earlier) due to a cookie header buffer overflow. The root cause is a vulnerable handling of the HTTP Cookie header (too long name/value) that can cause the server to crash. Some connected sources describe the impact ...

CVE-2004-0786

CVE-2004-0786 concerns a vulnerability in the apr-util IPv6 URI parsing (apr_uri_parse) used by Apache 2.x (APR library) prior to 2.0.50. A crafted IPv6 URL can trigger a denial-of-service in the httpd child process, with remote code execution possible under certain configurations or platforms. A...

CVE-2007-1862

The CVE-2007-1862 issue affects Apache 2.2.4’s mod_mem_cache recall_headers, where not all header levels are copied, potentially causing HTTP responses to include previously used data. This could lead to information disclosure to remote attackers. Connected advisories confirm affected packages an...

CVE-2004-0263

Technical details (affected product/version, root cause, impact, and remediation) are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-1999-1199

The CVE-1999-1199 entry concerns Apache HTTP Server 1.3.1 and earlier. A remote attacker can trigger a denial of service by sending a large number of MIME headers with the same name (the so‑called “sioux” vulnerability). The NVD entry assigns a base score of 10.0 (HIGH) with NETWORK attack vector...

CVE-2000-1205

CVE-2000-1205 covers cross-site scripting in Apache 1.3.0–1.3.11. The vulnerability allows remote attackers to execute script as other visitors via (1) printenv CGI (printenv.pl) output, (2) error pages generated by ap_send_error_response (e.g., default 404) that omit an explicit charset, or (3) ...

CVE-2002-1658

CVE-2002-1658 describes a buffer overflow in htdigest used by Apache 1.3.26/1.3.27 that may allow arbitrary code execution via a long user argument. The vulnerability is tied to htdigest functionality, with local access as the attack vector and no setuid/setgid context; escalation of privileges i...

CVE-2026-33523

CVE-2026-33523 describes an HTTP response splitting vulnerability in multiple Apache HTTP Server modules when backends are untrusted or compromised. Affected product: Apache HTTP Server up to version 2.4.66. The issue is resolved by upgrading to version 2.4.67. The provided documents do not inclu...

CVE-2002-1233

CVE-2002-1233 applies to Debian’s apache-ssl packages, where a regression in Apache 1.3.27 and earlier (Debian 2.2 before 1.3.9, Debian 3.0 before 1.3.26) allows local attackers to read or modify the Apache password file via a symlink attack when running htpasswd or htdigest. The issue reintroduc...

CVE-2003-0460

Apache rotatelogs vulnerability CVE-2003-0460 affects Apache 1.3.x before 1.3.28 on Windows/OS/2, where rotatelogs does not ignore certain control characters received over the pipe, potentially allowing remote attackers to cause a denial of service. Documents from NVD and CERT note that this coul...

CVE-2001-0729

CVE-2001-0729 concerns Apache HTTP Server on Windows (Win32) where a bug in Apache 1.3.20 can expose directory contents. The vulnerability arises when a client sends a very long URI composed of many forward slashes, allowing a remote attacker to bypass the default index page and cause directory l...

CVE-2003-0134

CVE-2003-0134 concerns Apache on OS/2 (versions 2.0–2.0.45) with a Denial of Service vulnerability in filestat.c related to device-name handling. Public details indicate the flaw could be triggered by specific requests involving device names, causing the running OS/2 worker process to fault. The ...

CVE-2003-0253

CVE-2003-0253 affects Apache 2.x with the prefork MPM before 2.0.47. A bug in handling accept() errors on rarely accessed ports could cause a temporary denial of service. The available connected documents consistently describe this as a DoS issue tied to the prefork MPM; remediation involves upgr...

CVE-2004-0751

Summary (grounded in provided docs): CVE-2004-0751 concerns the Apache httpd mod_ssl module. The issue arises when reverse proxying to an SSL server, where the char_buffer_read function can trigger a remote denial of service via a segmentation fault. Connected documents corroborate the vulnerabil...

CVE-2002-1850

The CVE-2002-1850 issue affects Apache’s mod_cgi in versions 2.0.39 and 2.0.40. A CGI script that writes a large amount of data to stderr can trigger a read/write deadlock between httpd and the CGI script, allowing local users and possibly remote attackers to cause a denial of service (hang and m...

CVE-2003-0189

CVE-2003-0189 detail (from connected documents): The Apache HTTP Server 2.0.40–2.0.45 on Unix platforms fails to handle thread safety in the apr_password_validate() path when crypt_r/crypt is used, enabling remote attackers to trigger a denial-of-service by breaking Basic Authentication under a t...

CVE-2003-0017

Apache HTTP Server on Windows versions older than 2.0.44 is affected by CVE-2003-0017. A crafted HTTP request containing illegal characters (for example, ">") can cause the server to process a different filename and disclose certain files. This vulnerability is a remote-access issue with netwo...