CVE-2024-38476

CVE-2024-38476 concerns Apache HTTP Server 2.4.59 and earlier where backend applications emitting malicious or exploitable response headers can lead to information disclosure, SSRF, or local script execution via internal redirects. The connected advisories confirm the issue affects httpd/core beh...

CVE-2023-38709

The Apache HTTP Server is vulnerable to an HTTP response splitting attack due to faulty input validation in its core. This flaw allows malicious or exploitable backend/content generators to split HTTP responses, which can be exploited by attackers who can manipulate the Content-Type response head...

CVE-2024-39884

A regression in the core of Apache HTTP Server 2.4.60 ignores legacy content-type based configurations for handlers. Under certain circumstances where files are requested indirectly, configurations such as "AddType" can result in the source code disclosure of local content. For instance, PHP scri...

CVE-2024-24795

The Apache HTTP Server is vulnerable to an HTTP response splitting attack due to faulty input validation in the core. This allows an attacker who can inject malicious response headers into backend applications to trigger an HTTP desynchronization attack . The issue affects versions through 2.4.58...

CVE-2024-36387

The Apache HTTP Server (specifically the mod_http2 module) is vulnerable to a Null Pointer dereference when serving WebSocket protocol upgrades over an HTTP/2 connection . This flaw can be exploited by an attacker to cause the server process to crash, resulting in a denial of service (DoS) and de...

CVE-2024-38474

CVE-2024-38474 affects Apache HTTP Server’s mod_rewrite: substitutions that capture and substitute unsafely can be mis-encoded, enabling unintended access paths. The issue is fixed by upgrading to Apache HTTP Server 2.4.60 (and related advisories note versions 2.4.61+ as subsequent fixes). Connec...

CVE-2024-27316

CVE-2024-27316 affects the mod_http2 component used with Apache httpd; the issue occurs when HTTP/2 headers exceed the configured limit, causing nghttp2 to buffer headers and potentially leading to memory exhaustion if the client continues sending headers. Connected sources identify affected pack...

CVE-2024-40898

The Apache HTTP Server (versions 2.4.0 to 2.4.61) contains a Server-Side Request Forgery (SSRF) vulnerability in the mod_rewrite module when used in a server/vhost context. This flaw allows an attacker to manipulate requests to potentially leak NTLM hashes to a malicious server. Additionally, som...

CVE-2024-38475

CVE-2024-38475 affects Apache HTTP Server 2.4.59 and earlier, where improper escaping of output in mod_rewrite can map URLs to filesystem locations that are served but not directly reachable, enabling remote code execution or source code disclosure. The issue also involves substitutions in server...

CVE-2024-38477

CVE-2024-38477 affects Apache HTTP Server 2.4.59 and earlier. The issue is a null pointer dereference in mod_proxy triggered by a malicious request, which can crash the server (Denial of Service). The published remediation is to upgrade to Apache HTTP Server 2.4.60, which fixes the issue. The CVE...

CVE-2024-38473

The Apache HTTP Server versions 2.4.59 and earlier are affected by an encoding problem within the mod_proxy component. This vulnerability allows request URLs with incorrect encoding to be forwarded to backend services, which may enable an attacker to bypass authentication using specially crafted ...

CVE-2024-39573

A potential SSRF vulnerability exists in the mod_rewrite module of Apache HTTP Server version 2.4.59 and earlier . The flaw is caused by insufficient checking of incoming requests, which allows an attacker to cause unsafe RewriteRules to unexpectedly set up URLs to be handled by mod_proxy . To re...

CVE-2024-38472

The Apache HTTP Server on Windows is vulnerable to a Server-Side Request Forgery (SSRF) flaw due to insufficient checking of incoming requests. An attacker can exploit this to leak NTLM hashes to a malicious server via malicious requests or content. To remediate, users should upgrade to version 2...

CVE-2024-40725

CVE-2024-40725 affects Apache HTTP Server core (httpd) and arises from a partial fix for CVE-2024-39884 in 2.4.61 that can leak local content when legacy content-type based configuration (AddType and similar) is used, potentially serving PHP scripts as source code under indirect requests. The iss...