# Apache Software Foundation Apache HTTP Server.

Every CVE that names Apache Software Foundation Apache HTTP Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache HTTP Server: mod_xml2enc crash on charset conversion failure](https://agentprime.io/advisories/CVE-2026-63686.md)
  `CVE-2026-63686` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_dav_fs namespace overflow](https://agentprime.io/advisories/CVE-2026-93546.md)
  `CVE-2026-93546` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_userdir information disclosure](https://agentprime.io/advisories/CVE-2026-79768.md)
  `CVE-2026-79768` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-55
- [Apache HTTP Server: mod_auth_digest DoS attack](https://agentprime.io/advisories/CVE-2026-73637.md)
  `CVE-2026-73637` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.3 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_auth_digest one-time-nonce replay attack](https://agentprime.io/advisories/CVE-2026-73636.md)
  `CVE-2026-73636` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Authentication bypass
- [Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling](https://agentprime.io/advisories/CVE-2026-63718.md)
  `CVE-2026-63718` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: HTTP request smuggling
- [Apache HTTP Server: mod_vhost_alias stack overflow](https://agentprime.io/advisories/CVE-2026-63292.md)
  `CVE-2026-63292` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_proxy_ftp PASV address handling](https://agentprime.io/advisories/CVE-2026-63045.md)
  `CVE-2026-63045` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function](https://agentprime.io/advisories/CVE-2026-59797.md)
  `CVE-2026-59797` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM](https://agentprime.io/advisories/CVE-2026-59685.md)
  `CVE-2026-59685` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_dav_fs property database read access](https://agentprime.io/advisories/CVE-2026-58415.md)
  `CVE-2026-58415` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy](https://agentprime.io/advisories/CVE-2026-57941.md)
  `CVE-2026-57941` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_proxy_html: crash in dump_content](https://agentprime.io/advisories/CVE-2026-56449.md)
  `CVE-2026-56449` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}](https://agentprime.io/advisories/CVE-2026-56154.md)
  `CVE-2026-56154` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char](https://agentprime.io/advisories/CVE-2026-56153.md)
  `CVE-2026-56153` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_auth_digest reauthentication attack](https://agentprime.io/advisories/CVE-2026-48005.md)
  `CVE-2026-48005` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Authentication bypass
- [Apache HTTP Server: mod_session: Session cookie not removed during internal redirect](https://agentprime.io/advisories/CVE-2026-47360.md)
  `CVE-2026-47360` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Apache HTTP Server: mod_heartmonitor denial of service](https://agentprime.io/advisories/CVE-2026-46729.md)
  `CVE-2026-46729` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories](https://agentprime.io/advisories/CVE-2026-42356.md)
  `CVE-2026-42356` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 3.7 Low · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-430
- [Apache HTTP Server: mod_dav shared lock overflow](https://agentprime.io/advisories/CVE-2026-42528.md)
  `CVE-2026-42528` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Denial of service
- [Apache HTTP Server: mod_http2 denial of service](https://agentprime.io/advisories/CVE-2026-49975.md)
  `CVE-2026-49975` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service, CWE-409
- [Apache HTTP Server: mod_http2 memory corruption when file handles exhausted](https://agentprime.io/advisories/CVE-2026-48913.md)
  `CVE-2026-48913` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.3 High · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_xml2enc heap overflow](https://agentprime.io/advisories/CVE-2026-42536.md)
  `CVE-2026-42536` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption
- [Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP \`send_request\`](https://agentprime.io/advisories/CVE-2026-44185.md)
  `CVE-2026-44185` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.3 High · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption, CWE-126
- [Apache HTTP Server: mod_proxy_html buffer overflow](https://agentprime.io/advisories/CVE-2026-34355.md)
  `CVE-2026-34355` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption
- [Apache HTTP Server: Heap Underflow in \`ap_regname\` via Signed Char Overflow](https://agentprime.io/advisories/CVE-2026-44631.md)
  `CVE-2026-44631` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption
- [Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules](https://agentprime.io/advisories/CVE-2026-44119.md)
  `CVE-2026-44119` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.5 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Privilege escalation
- [Apache HTTP Server: OOB Read in \`merge_response_headers\` can cause crash](https://agentprime.io/advisories/CVE-2026-43951.md)
  `CVE-2026-43951` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.5 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_dav_fs protected directory access](https://agentprime.io/advisories/CVE-2026-42535.md)
  `CVE-2026-42535` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jun 2026 · Tags: Information disclosure
- [Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow](https://agentprime.io/advisories/CVE-2026-34356.md)
  `CVE-2026-34356` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption
- [Apache HTTP Server: Loop in \`proxy_ftp_handler\` in mod_proxy_ftp](https://agentprime.io/advisories/CVE-2026-44186.md)
  `CVE-2026-44186` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.3 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service
- [Apache HTTP Server: mod_proxy_ftp XSS](https://agentprime.io/advisories/CVE-2026-29170.md)
  `CVE-2026-29170` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.1 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Apache HTTP Server: mod_ldap per-dir use-after-free](https://agentprime.io/advisories/CVE-2026-29167.md)
  `CVE-2026-29167` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption
- [Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()](https://agentprime.io/advisories/CVE-2026-28780.md)
  `CVE-2026-28780` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_md unrestricted OCSP response](https://agentprime.io/advisories/CVE-2026-29168.md)
  `CVE-2026-29168` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.3 High · Not analysed yet · Published 5 May 2026 · Tags: Denial of service
- [Apache HTTP Server: mod_dav_lock indirect lock crash](https://agentprime.io/advisories/CVE-2026-29169.md)
  `CVE-2026-29169` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 4 May 2026 · Tags: Memory corruption
- [Apache HTTP Server: http2: double free and possible RCE on early reset](https://agentprime.io/advisories/CVE-2026-23918.md)
  `CVE-2026-23918` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.50 · Not analysed yet · Published 4 May 2026 · Tags: Memory corruption, CWE-1341
- [Apache HTTP Server: mod_auth_digest timing attack](https://agentprime.io/advisories/CVE-2026-33006.md)
  `CVE-2026-33006` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 4.8 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-208
- [Apache HTTP Server: mod_authn_socache crash](https://agentprime.io/advisories/CVE-2026-33007.md)
  `CVE-2026-33007` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Memory corruption
- [Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line](https://agentprime.io/advisories/CVE-2026-33523.md)
  `CVE-2026-33523` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.5 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-443
- [Apache HTTP Server: Off-by-one OOB reads in AJP getter functions](https://agentprime.io/advisories/CVE-2026-33857.md)
  `CVE-2026-33857` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Memory corruption
- [Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)](https://agentprime.io/advisories/CVE-2026-34032.md)
  `CVE-2026-34032` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Memory corruption, CWE-170
- [Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()](https://agentprime.io/advisories/CVE-2026-34059.md)
  `CVE-2026-34059` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-126
- [Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr](https://agentprime.io/advisories/CVE-2026-24072.md)
  `CVE-2026-24072` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.8 High · Not analysed yet · Published 4 May 2026 · Tags: Privilege escalation
- [Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...](https://agentprime.io/advisories/CVE-2025-58098.md)
  `CVE-2025-58098` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.3 High · Not analysed yet · Published 5 Dec 2025 · Tags: Information disclosure
- [Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo](https://agentprime.io/advisories/CVE-2025-66200.md)
  `CVE-2025-66200` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.4 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Authentication bypass
- [Apache HTTP Server: CGI environment variable override](https://agentprime.io/advisories/CVE-2025-65082.md)
  `CVE-2025-65082` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.5 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-150
- [Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF](https://agentprime.io/advisories/CVE-2025-59775.md)
  `CVE-2025-59775` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 5 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Apache HTTP Server: mod_md (ACME), unintended retry intervals](https://agentprime.io/advisories/CVE-2025-55753.md)
  `CVE-2025-55753` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 5 Dec 2025 · Tags: Memory corruption
- [Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64](https://agentprime.io/advisories/CVE-2025-54090.md)
  `CVE-2025-54090` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.3 Medium · Not analysed yet · Published 23 Jul 2025 · Tags: CWE-253
- [Apache HTTP Server: HTTP/2 DoS by Memory Increase](https://agentprime.io/advisories/CVE-2025-53020.md)
  `CVE-2025-53020` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Denial of service
- [Apache HTTP Server: mod_ssl TLS upgrade attack](https://agentprime.io/advisories/CVE-2025-49812.md)
  `CVE-2025-49812` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.4 High · Not analysed yet · Published 10 Jul 2025 · Tags: Authentication bypass
- [Apache HTTP Server: mod_proxy_http2 denial of service](https://agentprime.io/advisories/CVE-2025-49630.md)
  `CVE-2025-49630` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Denial of service
- [Apache HTTP Server: mod_ssl access control bypass with session resumption](https://agentprime.io/advisories/CVE-2025-23048.md)
  `CVE-2025-23048` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2025 · Tags: Broken access control
- [Apache HTTP Server: SSRF on Windows due to UNC paths](https://agentprime.io/advisories/CVE-2024-43394.md)
  `CVE-2024-43394` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Server-side request forgery (SSRF)
- [Apache HTTP Server: mod_ssl error log variable escaping](https://agentprime.io/advisories/CVE-2024-47252.md)
  `CVE-2024-47252` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: CWE-150
- [Apache HTTP Server: SSRF with mod_headers setting Content-Type header](https://agentprime.io/advisories/CVE-2024-43204.md)
  `CVE-2024-43204` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Server-side request forgery (SSRF)
- [Apache HTTP Server: HTTP response splitting](https://agentprime.io/advisories/CVE-2024-42516.md)
  `CVE-2024-42516` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: CWE-20
- [Apache HTTP Server: source code disclosure with handlers configured via AddType](https://agentprime.io/advisories/CVE-2024-40725.md)
  `CVE-2024-40725` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2024 · Tags: Information disclosure
- [Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows](https://agentprime.io/advisories/CVE-2024-40898.md)
  `CVE-2024-40898` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jul 2024 · Tags: Server-side request forgery (SSRF)

Older: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-http-server.md?cursor=WyIyMDI0LTA3LTE4VDA5OjMyOjA2Ljk5MDAwMFoiLCJDVkUtMjAyNC00MDg5OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-http-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-http-server/>. Everything for agents: <https://agentprime.io/llms.txt>.