CVE-2025-23048

The Apache HTTP Server (versions 2.4.35 through 2.4.63) is vulnerable to an access control bypass in certain mod_ssl configurations. The root cause involves TLS 1.3 session resumption , where a client trusted to access one virtual host can gain unauthorized access to another virtual host. This sp...

CVE-2025-58098

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes th...

CVE-2025-59775

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache HTTP Server on Windows systems. When the configuration has AllowEncodedSlashes On and MergeSlashes Off , the vulnerability allows an attacker to potentially leak NTLM hashes to a malicious server via SSRF and specially crafted re...

CVE-2025-53020

The Apache HTTP Server versions 2.4.17 through 2.4.63 are vulnerable to a Late Release of Memory after Effective Lifetime issue. This memory leak vulnerability can be exploited by an attacker to cause a Denial of Service (DoS) , potentially leading to service failure or interruptions. Impacted co...

CVE-2025-66200

A vulnerability in the Apache HTTP Server (versions 2.4.7 through 2.4.65) allows a mod_userdir+suexec bypass via the AllowOverride FileInfo directive. Attackers who can use the RequestHeader directive in an htaccess file can cause certain CGI scripts to execute under an unexpected userid . This i...

CVE-2025-55753

An integer overflow in the mod_md module of the Apache HTTP Server (versions 2.4.30 through 2.4.65) can lead to unintended behavior during failed ACME certificate renewals . Under default configurations, repeated failures over approximately 30 days cause the backoff timer to become 0, resulting i...

CVE-2025-65082

The Apache HTTP Server (versions 2.4.0 through 2.4.65) is vulnerable to an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability. The root cause is that environment variables set via the Apache configuration unexpectedly supersede variables calculated by the server for CGI p...

CVE-2025-49812

Apache HTTP Server versions through 2.4.63 are vulnerable to an HTTP desynchronisation attack in certain mod_ssl configurations. This flaw allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. The vulnerability specifically affects configurations using "SSLEngine option...

CVE-2024-47252

Apache HTTP Server versions 2.4.63 and earlier are vulnerable to a security flaw in the mod_ssl module caused by insufficient escaping of user-supplied data. Specifically, when CustomLog is configured to log variables provided by mod_ssl (such as SSL_TLS_SNI ) using the "%{varname}x" or "%{varnam...

CVE-2024-42516

The Apache HTTP Server core is vulnerable to HTTP response splitting due to an input validation error. An attacker capable of manipulating the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response, potentially compromising the integrity of prote...

CVE-2025-49630

The Apache HTTP Server (versions 2.4.26 through 2.4.63) is vulnerable to a denial of service (DoS) attack due to an assertion failure in the mod_proxy_http2 module. This issue is triggered by untrusted clients in specific configurations where a reverse proxy is set up for an HTTP/2 backend with P...

CVE-2024-43394

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache HTTP Server on Windows (versions 2.4.0 through 2.4.63 ). The root cause is the processing of unvalidated request input via mod_rewrite or Apache expressions , which allows an attacker to potentially leak NTLM hashes to a maliciou...

CVE-2025-54090

A bug in Apache HTTP Server 2.4.64 causes all "RewriteCond expr ..." tests to incorrectly evaluate as "true" . This flaw can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information by bypassing intended rewrite logic. Remote exploitation is possibl...

CVE-2024-43204

A Server-Side Request Forgery (SSRF) vulnerability exists in the Apache HTTP Server when mod_proxy is loaded. The root cause is insufficient validation of requests, which allows an attacker to send outbound proxy requests to an attacker-controlled URL. This vulnerability specifically requires an ...

CVE-2025-3891

CVE-2025-3891 affects the Apache httpd mod_auth_openidc module. A remote, unauthenticated attacker can cause a DoS by sending an empty POST when the OIDCPreservePost directive is enabled, crashing the server and impacting availability. Evidence from multiple advisories confirms the issue and ment...