# Apache Software Foundation Apache HTTP Server.

Every CVE that names Apache Software Foundation Apache HTTP Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Apache HTTP Server: source code disclosure with handlers configured via AddType](https://agentprime.io/advisories/CVE-2024-39884.md)
  `CVE-2024-39884` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.2 Medium · Not analysed yet · Published 4 Jul 2024
- [Apache HTTP Server: mod_rewrite proxy handler substitution](https://agentprime.io/advisories/CVE-2024-39573.md)
  `CVE-2024-39573` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-20
- [Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request](https://agentprime.io/advisories/CVE-2024-38477.md)
  `CVE-2024-38477` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2024 · Tags: Memory corruption
- [Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect](https://agentprime.io/advisories/CVE-2024-38476.md)
  `CVE-2024-38476` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.42 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-829
- [Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.](https://agentprime.io/advisories/CVE-2024-38475.md)
  `CVE-2024-38475` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.1 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-116
- [Apache HTTP Server weakness with encoded question marks in backreferences](https://agentprime.io/advisories/CVE-2024-38474.md)
  `CVE-2024-38474` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.1 High · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-116
- [Apache HTTP Server proxy encoding problem](https://agentprime.io/advisories/CVE-2024-38473.md)
  `CVE-2024-38473` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-116
- [Apache HTTP Server on WIndows UNC SSRF](https://agentprime.io/advisories/CVE-2024-38472.md)
  `CVE-2024-38472` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.69 · Not analysed yet · Published 1 Jul 2024 · Tags: Server-side request forgery (SSRF)
- [Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2](https://agentprime.io/advisories/CVE-2024-36387.md)
  `CVE-2024-36387` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.4 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Memory corruption
- [Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames](https://agentprime.io/advisories/CVE-2024-27316.md)
  `CVE-2024-27316` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.89 · Not analysed yet · Published 4 Apr 2024 · Tags: Denial of service
- [Apache HTTP Server: HTTP Response Splitting in multiple modules](https://agentprime.io/advisories/CVE-2024-24795.md)
  `CVE-2024-24795` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.3 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Other injection, HTTP request smuggling
- [Apache HTTP Server: HTTP response splitting](https://agentprime.io/advisories/CVE-2023-38709.md)
  `CVE-2023-38709` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.3 High · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-1284
- [Apache HTTP Server: mod_macro buffer over-read](https://agentprime.io/advisories/CVE-2023-31122.md)
  `CVE-2023-31122` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 23 Oct 2023 · Tags: Memory corruption
- [Apache HTTP Server: DoS in HTTP/2 with initial windows size 0](https://agentprime.io/advisories/CVE-2023-43622.md)
  `CVE-2023-43622` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.69 · Not analysed yet · Published 23 Oct 2023 · Tags: Denial of service
- [Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST](https://agentprime.io/advisories/CVE-2023-45802.md)
  `CVE-2023-45802` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 23 Oct 2023 · Tags: Denial of service
- [Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy](https://agentprime.io/advisories/CVE-2023-25690.md)
  `CVE-2023-25690` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.85 · Not analysed yet · Published 7 Mar 2023 · Tags: HTTP request smuggling
- [Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting](https://agentprime.io/advisories/CVE-2022-37436.md)
  `CVE-2022-37436` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · EPSS 0.53 · Not analysed yet · Published 17 Jan 2023 · Tags: Other injection
- [Apache HTTP Server: mod_proxy_ajp Possible request smuggling](https://agentprime.io/advisories/CVE-2022-36760.md)
  `CVE-2022-36760` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jan 2023 · Tags: HTTP request smuggling
- [Apache HTTP Server: mod_dav out of bounds read, or write of zero byte](https://agentprime.io/advisories/CVE-2006-20001.md)
  `CVE-2006-20001` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 17 Jan 2023 · Tags: Memory corruption
- [mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism](https://agentprime.io/advisories/CVE-2022-31813.md)
  `CVE-2022-31813` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 8 Jun 2022 · Tags: CWE-348
- [Information Disclosure in mod_lua with websockets](https://agentprime.io/advisories/CVE-2022-30556.md)
  `CVE-2022-30556` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 8 Jun 2022 · Tags: Information disclosure
- [mod_sed denial of service](https://agentprime.io/advisories/CVE-2022-30522.md)
  `CVE-2022-30522` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.90 · Not analysed yet · Published 8 Jun 2022 · Tags: Denial of service
- [Denial of service in mod_lua r:parsebody](https://agentprime.io/advisories/CVE-2022-29404.md)
  `CVE-2022-29404` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 8 Jun 2022 · Tags: Denial of service
- [Read beyond bounds in ap_strcmp_match()](https://agentprime.io/advisories/CVE-2022-28615.md)
  `CVE-2022-28615` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jun 2022 · Tags: Memory corruption
- [read beyond bounds via ap_rwrite()](https://agentprime.io/advisories/CVE-2022-28614.md)
  `CVE-2022-28614` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 8 Jun 2022 · Tags: Memory corruption, Information disclosure
- [read beyond bounds in mod_isapi](https://agentprime.io/advisories/CVE-2022-28330.md)
  `CVE-2022-28330` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 8 Jun 2022 · Tags: Memory corruption
- [mod_proxy_ajp: Possible request smuggling](https://agentprime.io/advisories/CVE-2022-26377.md)
  `CVE-2022-26377` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.21 · Not analysed yet · Published 8 Jun 2022 · Tags: HTTP request smuggling
- [mod_sed: Read/write beyond bounds](https://agentprime.io/advisories/CVE-2022-23943.md)
  `CVE-2022-23943` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.50 · Not analysed yet · Published 14 Mar 2022 · Tags: Memory corruption
- [core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody](https://agentprime.io/advisories/CVE-2022-22721.md)
  `CVE-2022-22721` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.42 · Not analysed yet · Published 14 Mar 2022 · Tags: Memory corruption
- [HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier](https://agentprime.io/advisories/CVE-2022-22720.md)
  `CVE-2022-22720` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.28 · Not analysed yet · Published 14 Mar 2022 · Tags: HTTP request smuggling
- [mod_lua Use of uninitialized value of in r:parsebody](https://agentprime.io/advisories/CVE-2022-22719.md)
  `CVE-2022-22719` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.70 · Not analysed yet · Published 14 Mar 2022 · Tags: CWE-665
- [Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier](https://agentprime.io/advisories/CVE-2021-44224.md)
  `CVE-2021-44224` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.82 · Not analysed yet · Published 20 Dec 2021 · Tags: Memory corruption
- [Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier](https://agentprime.io/advisories/CVE-2021-44790.md)
  `CVE-2021-44790` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.97 · Not analysed yet · Published 20 Dec 2021 · Tags: Memory corruption
- [Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)](https://agentprime.io/advisories/CVE-2021-42013.md)
  `CVE-2021-42013` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 7 Oct 2021 · Tags: Path traversal
- [Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49](https://agentprime.io/advisories/CVE-2021-41773.md)
  `CVE-2021-41773` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 5 Oct 2021 · Tags: Path traversal
- [null pointer dereference in h2 fuzzing](https://agentprime.io/advisories/CVE-2021-41524.md)
  `CVE-2021-41524` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.26 · Not analysed yet · Published 5 Oct 2021 · Tags: Memory corruption
- [mod_proxy SSRF](https://agentprime.io/advisories/CVE-2021-40438.md)
  `CVE-2021-40438` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 16 Sept 2021 · Tags: Server-side request forgery (SSRF)
- [ap_escape_quotes buffer overflow](https://agentprime.io/advisories/CVE-2021-39275.md)
  `CVE-2021-39275` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.39 · Not analysed yet · Published 16 Sept 2021
- [mod_proxy_uwsgi out of bound read](https://agentprime.io/advisories/CVE-2021-36160.md)
  `CVE-2021-36160` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.64 · Not analysed yet · Published 16 Sept 2021 · Tags: Memory corruption
- [NULL pointer dereference in httpd core](https://agentprime.io/advisories/CVE-2021-34798.md)
  `CVE-2021-34798` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.65 · Not analysed yet · Published 16 Sept 2021 · Tags: Memory corruption
- [Request splitting via HTTP/2 method injection and mod_proxy](https://agentprime.io/advisories/CVE-2021-33193.md)
  `CVE-2021-33193` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.46 · Not analysed yet · Published 16 Aug 2021
- [NULL pointer dereference on specially crafted HTTP/2 request](https://agentprime.io/advisories/CVE-2021-31618.md)
  `CVE-2021-31618` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.52 · Not analysed yet · Published 15 Jun 2021 · Tags: Memory corruption
- [Unexpected URL matching with 'MergeSlashes OFF'](https://agentprime.io/advisories/CVE-2021-30641.md)
  `CVE-2021-30641` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.52 · Not analysed yet · Published 10 Jun 2021
- [Apache HTTP Server mod_session response handling heap overflow](https://agentprime.io/advisories/CVE-2021-26691.md)
  `CVE-2021-26691` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.68 · Not analysed yet · Published 10 Jun 2021 · Tags: Memory corruption
- [mod_session NULL pointer dereference](https://agentprime.io/advisories/CVE-2021-26690.md)
  `CVE-2021-26690` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.65 · Not analysed yet · Published 10 Jun 2021
- [mod_auth_digest possible stack overflow by one nul byte](https://agentprime.io/advisories/CVE-2020-35452.md)
  `CVE-2020-35452` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.53 · Not analysed yet · Published 10 Jun 2021
- [mod_proxy_http NULL pointer dereference](https://agentprime.io/advisories/CVE-2020-13950.md)
  `CVE-2020-13950` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.50 · Not analysed yet · Published 10 Jun 2021
- [Improper Handling of Insufficient Privileges](https://agentprime.io/advisories/CVE-2020-13938.md)
  `CVE-2020-13938` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.12 · Not analysed yet · Published 10 Jun 2021
- [mod_proxy_wstunnel tunneling of non Upgraded connections](https://agentprime.io/advisories/CVE-2019-17567.md)
  `CVE-2019-17567` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.60 · Not analysed yet · Published 10 Jun 2021
- [A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.](https://agentprime.io/advisories/CVE-2019-0197.md)
  `CVE-2019-0197` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 11 Jun 2019
- [A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.](https://agentprime.io/advisories/CVE-2019-0196.md)
  `CVE-2019-0196` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.19 · Not analysed yet · Published 11 Jun 2019
- [A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.](https://agentprime.io/advisories/CVE-2019-0220.md)
  `CVE-2019-0220` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.18 · Not analysed yet · Published 11 Jun 2019
- [A bug exists in the way mod_ssl handled client renegotiations.](https://agentprime.io/advisories/CVE-2019-0190.md)
  `CVE-2019-0190` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.60 · Not analysed yet · Published 30 Jan 2019
- [Apache Software Foundation Apache HTTP Server: In Apache HTTP Server 2.4 release 2.4.37 and prior…](https://agentprime.io/advisories/CVE-2018-17199.md)
  `CVE-2018-17199` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.20 · Not analysed yet · Published 30 Jan 2019
- [Apache Software Foundation Apache HTTP Server: In Apache HTTP server versions 2.4.37 and prior…](https://agentprime.io/advisories/CVE-2018-17189.md)
  `CVE-2018-17189` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.19 · Not analysed yet · Published 30 Jan 2019
- [Apache Software Foundation Apache HTTP Server: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous…](https://agentprime.io/advisories/CVE-2018-11763.md)
  `CVE-2018-11763` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.51 · Not analysed yet · Published 25 Sept 2018
- [mod_userdir CRLF injection](https://agentprime.io/advisories/CVE-2016-4975.md)
  `CVE-2016-4975` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.20 · Not analysed yet · Published 14 Aug 2018
- [mod_md, DoS via Coredumps on specially crafted requests](https://agentprime.io/advisories/CVE-2018-8011.md)
  `CVE-2018-8011` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.55 · Not analysed yet · Published 18 Jul 2018
- [DoS for HTTP/2 connections by crafted requests](https://agentprime.io/advisories/CVE-2018-1333.md)
  `CVE-2018-1333` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.17 · Not analysed yet · Published 18 Jun 2018
- [In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed.](https://agentprime.io/advisories/CVE-2018-1312.md)
  `CVE-2018-1312` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.16 · Not analysed yet · Published 26 Mar 2018

Newest: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-http-server.md>
Older: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-http-server.md?cursor=WyIyMDE4LTAzLTI2VDE1OjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC0xMzEyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-http-server&cursor=WyIyMDI0LTA3LTE4VDA5OjMyOjA2Ljk5MDAwMFoiLCJDVkUtMjAyNC00MDg5OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-http-server/?cursor=WyIyMDI0LTA3LTE4VDA5OjMyOjA2Ljk5MDAwMFoiLCJDVkUtMjAyNC00MDg5OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.