CVE-2017-7679

CVE-2017-7679 affects Apache HTTP Server (httpd) mod_mime. A buffer over-read allows reading one byte past the end of a buffer when sending a malicious Content-Type header, potentially enabling a crash or memory access issues. Affected products include httpd 2.2.x before 2.2.33 and 2.4.x before 2...

CVE-2022-31813

CVE-2022-31813 affects Apache HTTP Server 2.4.53 and older; due to hop-by-hop handling, X-Forwarded-* headers may be dropped to the origin server, which can enable bypass of IP-based authentication. All connected advisories indicate the fix is in Apache HTTP Server 2.4.54 and related updates in d...

CVE-2020-11984

CVE-2020-11984 affects Apache HTTP Server mod_proxy_uwsgi. Based on the provided documents, it is a vulnerability in httpd’s uwsgi handling that can lead to information disclosure and potentially remote code execution. The vulnerability was reported for Apache HTTP Server versions around 2.4.32 t...

CVE-2022-23943

CVE-2022-23943 is an out-of-bounds write vulnerability in httpd’s mod_sed that could allow memory corruption by attacker-supplied data. Affected: Apache HTTP Server 2.4.52 and earlier. Mitigation: upgrade to a fixed release (e.g., httpd 2.4.53 or later) as indicated by multiple advisories (includ...

CVE-2024-38476

CVE-2024-38476 concerns Apache HTTP Server 2.4.59 and earlier where backend applications emitting malicious or exploitable response headers can lead to information disclosure, SSRF, or local script execution via internal redirects. The connected advisories confirm the issue affects httpd/core beh...

CVE-2023-25690

CVE-2023-25690 concerns Apache HTTP Server 2.4.0–2.4.55 with mod_proxy enabled when combined with certain RewriteRule or ProxyPassMatch patterns that re-insert user-supplied URL data into the proxied request-target via variable substitution. The underlying flaw enables HTTP request smuggling thro...

CVE-2022-22720

CVE-2022-22720 – Apache httpd HTTP Request Smuggling (details from connected docs) Affected software: Apache HTTP Server (httpd) versions 2.4.52 and earlier. Root cause / description: Inbound connections are not closed when errors occur while discarding the request body, which can expose the serv...

CVE-2017-3167

CVE-2017-3167 affects Apache httpd 2.2.x prior to 2.2.33 and 2.4.x prior to 2.4.26. The issue is that third‑party modules using ap_get_basic_auth_pw() outside the authentication phase can bypass authentication requirements. Connected sources confirm the impact and upstream fixes: update to httpd ...

CVE-2021-26691

CVE-2021-26691 affects Apache HTTP Server, where a crafted SessionHeader can cause a heap overflow in 2.4.0–2.4.46. Several connected advisories indicate that updates have been released (e.g., AlmaLinux/CentOS/Red Hat ecosystems) and that newer Apache HTTP Server versions (e.g., 2.4.51 in Check P...

CVE-2018-1312

CVE-2018-1312 affects Apache httpd 2.2.0–2.4.29 where nonce generation for HTTP Digest authentication was not seeded with a proper pseudo-random seed. This allowed replay across servers in a common Digest configuration. Public advisories (CentOS, Debian, Arch Linux, ALT Linux) fix confirmed in ve...

CVE-2021-44790

CVE-2021-44790 affects Apache HTTP Server up to version 2.4.51. It describes a buffer overflow in the mod_lua multipart parser (triggered via r:parsebody() from Lua scripts). Connected documents corroborate this in various advisories and patch notes, indicating releases with fixes (e.g., patched ...

CVE-2021-39275

CVE-2021-39275 affects Apache HTTP Server (httpd) up to 2.4.48 and earlier. The issue is an out-of-bounds write in ap_escape_quotes() when given malicious input, potentially crashing the server or enabling code execution in some environments. Several connected sources concur this vulnerability ex...

CVE-2017-3169

CVE-2017-3169 affects Apache HTTP Server (httpd) up to the fixed versions: 2.2.x before 2.2.33 and 2.4.x before 2.4.26. The vulnerability is a NULL pointer dereference in the httpd’s mod_ssl component when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS po...

CVE-2021-40438

CVE-2021-40438 is an SSRF flaw in Apache HTTP Server 2.4.x through older revisions where a crafted request URI path can cause mod_proxy to forward the request to an origin server chosen by the remote user. The issue affects Apache httpd 2.4.48 and earlier; the CVSSv3.1 base score is 9.0 (CRITICAL...

CVE-2022-28615

CVE-2022-28615 affects Apache HTTP Server 2.4.53 and earlier, where a read beyond bounds can occur in ap_strcmp_match() when given a very large input buffer. The issue may affect third‑party modules or lua scripts that call this function. Advisories in connected documents reference an official fi...

CVE-2021-41773

CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 affecting how path normalization maps URLs to files under Alias-like directives. The issue could allow access to files outside configured directories; if CGI scripts are enabled for those paths, remote code execution is...

CVE-2019-10082

CVE-2019-10082 affects Apache HTTP Server 2.4.18–2.4.39, where fuzzed network input could cause read-after-free in http/2 session shutdown. Impact: remote, unauthenticated triggering memory faults in httpd workers, enabling potential DoS and other consequences. Connected sources indicate remediat...

CVE-2017-9788

Apache httpd versions prior to 2.2.34 and 2.4.x before 2.4.27 are vulnerable to a memory management flaw in the mod_auth_digest module. The value placeholder in [Proxy-]Authorization headers of type 'Digest ' is not properly initialized or reset between successive key=value assignments. An attack...

CVE-2024-38474

CVE-2024-38474 affects Apache HTTP Server’s mod_rewrite: substitutions that capture and substitute unsafely can be mis-encoded, enabling unintended access paths. The issue is fixed by upgrading to Apache HTTP Server 2.4.60 (and related advisories note versions 2.4.61+ as subsequent fixes). Connec...

CVE-2022-36760

CVE-2022-36760 affects Apache HTTP Server mod_proxy_ajp, enabling HTTP Request Smuggling by an attacker to forward requests to the AJP backend. Public docs confirm impact on Apache httpd 2.4.54 and earlier; remediation is to upgrade to a fixed release (e.g., httpd 2.4.55+ as referenced by advisor...

CVE-2022-22721

CVE-2022-22721 concerns the Apache HTTP Server. On 32-bit systems, if LimitXMLRequestBody is set to allow request bodies larger than 350 MB (default 1 MB), an integer overflow can occur, leading to out-of-bounds writes. Affected product: Apache HTTP Server 2.4.52 and earlier. Impact per sources: ...

CVE-2021-42013

Summary: CVE-2021-42013 covers an incomplete fix to CVE-2021-41773 in Apache HTTP Server 2.4.49/2.4.50. Root cause: path traversal vulnerabilities in the 2.4.50 fix could map URLs outside configured directories; if CGI is enabled for aliased paths, remote code execution could occur. Affected vers...

CVE-2024-40898

The Apache HTTP Server (versions 2.4.0 to 2.4.61 ) is affected by a high-severity vulnerability (CVE-2024-40898) involving the mod_rewrite module. When configured in a server/vhost context , insufficient validation of incoming requests can lead to Server-Side Request Forgery (SSRF) . This allows ...

CVE-2024-38475

CVE-2024-38475 affects Apache HTTP Server 2.4.59 and earlier, where improper escaping of output in mod_rewrite can map URLs to filesystem locations that are served but not directly reachable, enabling remote code execution or source code disclosure. The issue also involves substitutions in server...

CVE-2026-44631

The Apache HTTP Server is vulnerable to a buffer underwrite (and in some contexts described as buffer overflow or buffer limit violation ) due to the use of poorly crafted regular expressions in the configuration. This issue impacts versions 2.4.0 through 2.4.67 . Exploitation can lead to service...

CVE-2009-3555

The TLS and SSL 3.0 (and possibly earlier) protocols, used in various products including Microsoft IIS 7.0 , mod_ssl in Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla NSS 3.12.4 and earlier, and multiple Cisco products, fail to properly associate r...

CVE-2025-23048

The Apache HTTP Server (versions 2.4.35 through 2.4.63) is vulnerable to an access control bypass in certain mod_ssl configurations. This issue occurs during TLS 1.3 session resumption when the server is configured with multiple virtual hosts, each restricted to different sets of trusted client c...

CVE-2026-29167

A Use After Free vulnerability exists in the Apache HTTP Server when using the mod_ldap module in a per-directory configuration . This flaw allows an attacker to utilize memory after it has been freed, potentially leading to arbitrary code execution or a denial-of-service attack. The issue affect...

CVE-2026-28780

Apache HTTP Server versions through 2.4.66 are vulnerable to a heap-based buffer overflow in the mod_proxy_ajp module. The root cause is an off-by-AJP_HEADER_LEN check in the ajp_msg_check_header function, which allows a malicious AJP server to send a crafted message that causes the server to wri...

CVE-2026-42535

A path handling issue in the mod_dav_fs module of Apache HTTP Server versions 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases . This manipulation can potentially result in child process crashes , leading to a Denial of Service (DoS) conditio...

CVE-2026-59797

The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is affected by an Improper Privilege Management vulnerability in the mod_ssl component. The issue occurs via SSLRequire and file-related expressions, specifically where it allows .htaccess ap_expr file-function usage. The vulnerability has b...

CVE-2026-57941

A Use After Free vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.68 . The flaw is located within the mod_http2 component and is triggered via shared session->bbtmp re-entrancy . This vulnerability can lead to a wild write , and the security impact is rated as moderate . N...

CVE-2026-56154

A Use After Free vulnerability exists in the mod_rewrite module of the Apache HTTP Server (versions 2.4.0 through 2.4.68 ). The flaw is triggered when using lookahead functionality, specifically via the %{LA-U:HTTP:...} syntax. While the CVSS 3.1 score indicates a CRITICAL severity of 9.8 with po...

CVE-2001-0766

CVE-2001-0766 affects Apache on MacOS X Client 10.0.3 with HFS+; a case-insensitive filesystem leads to bypassing URL-based access filters. The root cause is that Apache’s file access protection assumes a case-sensitive FS, so URLs with mixed case can bypass / restrictions, potentially exposing p...