Advisories · Technology

Apache Software Foundation Apache HTTP Server.

Every CVE that names Apache Software Foundation Apache HTTP Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-63686 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_xml2enc crash on charset conversion failure
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-93546 CVE record

CVSS 8.8 High

Apache HTTP Server: mod_dav_fs namespace overflow
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-79768 CVE record

CVSS 5.3 Medium

Apache HTTP Server: mod_userdir information disclosure
- Apache Software Foundation Apache HTTP Server
- CWE-55
Not analysed yet 1 Oct 2026
CVE-2026-73637 CVE record

CVSS 7.3 High

Apache HTTP Server: mod_auth_digest DoS attack
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-73636 CVE record

CVSS 8.1 High

Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
- Apache Software Foundation Apache HTTP Server
- Authentication bypass
Not analysed yet 1 Oct 2026
CVE-2026-63718 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
- Apache Software Foundation Apache HTTP Server
- HTTP request smuggling
Not analysed yet 1 Oct 2026
CVE-2026-63292 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_vhost_alias stack overflow
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-63045 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_proxy_ftp PASV address handling
- Apache Software Foundation Apache HTTP Server
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-59797 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
- Apache Software Foundation Apache HTTP Server
- Privilege escalation
Not analysed yet 1 Oct 2026
CVE-2026-59685 CVE record

CVSS 7.5 High

Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-58415 CVE record

CVSS 5.3 Medium

Apache HTTP Server: mod_dav_fs property database read access
- Apache Software Foundation Apache HTTP Server
- Information disclosure
Not analysed yet 1 Oct 2026
CVE-2026-57941 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-56449 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_proxy_html: crash in dump_content
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-56154 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-56153 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-48005 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_auth_digest reauthentication attack
- Apache Software Foundation Apache HTTP Server
- Authentication bypass
Not analysed yet 1 Oct 2026
CVE-2026-47360 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
- Apache Software Foundation Apache HTTP Server
- Information disclosure
Not analysed yet 1 Oct 2026
CVE-2026-46729 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_heartmonitor denial of service
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Oct 2026
CVE-2026-42356 CVE record

CVSS 3.7 Low

Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
- Apache Software Foundation Apache HTTP Server
- CWE-430
Not analysed yet 1 Oct 2026
CVE-2026-42528 CVE record

CVSS 4.3 Medium

Apache HTTP Server: mod_dav shared lock overflow
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 1 Oct 2026
CVE-2026-49975 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Apache HTTP Server: mod_http2 denial of service
- Apache Software Foundation Apache HTTP Server
- Denial of service
- CWE-409
Not analysed yet 8 Jun 2026
CVE-2026-48913 CVE record

CVSS 7.3 High

Apache HTTP Server: mod_http2 memory corruption when file handles exhausted
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2026
CVE-2026-42536 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_xml2enc heap overflow
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2026
CVE-2026-44185 CVE record

CVSS 7.3 High

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
- Apache Software Foundation Apache HTTP Server
- Memory corruption
- CWE-126
Not analysed yet 8 Jun 2026
CVE-2026-34355 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_proxy_html buffer overflow
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2026
CVE-2026-44631 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2026
CVE-2026-44119 CVE record

CVSS 5.5 Medium

Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules
- Apache Software Foundation Apache HTTP Server
- Privilege escalation
Not analysed yet 8 Jun 2026
CVE-2026-43951 CVE record

CVSS 6.5 Medium

Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2026
CVE-2026-42535 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache HTTP Server: mod_dav_fs protected directory access
- Apache Software Foundation Apache HTTP Server
- Information disclosure
Not analysed yet 8 Jun 2026
CVE-2026-34356 CVE record

CVSS 7.5 High

Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2026
CVE-2026-44186 CVE record

CVSS 7.3 High

Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 8 Jun 2026
CVE-2026-29170 CVE record

CVSS 6.1 Medium

Apache HTTP Server: mod_proxy_ftp XSS
- Apache Software Foundation Apache HTTP Server
- Cross-site scripting (XSS)
Not analysed yet 8 Jun 2026
CVE-2026-29167 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache HTTP Server: mod_ldap per-dir use-after-free
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2026
CVE-2026-28780 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 5 May 2026
CVE-2026-29168 CVE record

CVSS 7.3 High

Apache HTTP Server: mod_md unrestricted OCSP response
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 5 May 2026
CVE-2026-29169 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_dav_lock indirect lock crash
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 4 May 2026
CVE-2026-23918 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Apache HTTP Server: http2: double free and possible RCE on early reset
- Apache Software Foundation Apache HTTP Server
- Memory corruption
- CWE-1341
Not analysed yet 4 May 2026
CVE-2026-33006 CVE record

CVSS 4.8 Medium

Apache HTTP Server: mod_auth_digest timing attack
- Apache Software Foundation Apache HTTP Server
- CWE-208
Not analysed yet 4 May 2026
CVE-2026-33007 CVE record

CVSS 5.3 Medium

Apache HTTP Server: mod_authn_socache crash
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 4 May 2026
CVE-2026-33523 CVE record

CVSS 6.5 Medium

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
- Apache Software Foundation Apache HTTP Server
- CWE-443
Not analysed yet 4 May 2026
CVE-2026-33857 CVE record

CVSS 5.3 Medium

Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 4 May 2026
CVE-2026-34032 CVE record

CVSS 5.3 Medium

Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
- Apache Software Foundation Apache HTTP Server
- Memory corruption
- CWE-170
Not analysed yet 4 May 2026
CVE-2026-34059 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
- Apache Software Foundation Apache HTTP Server
- CWE-126
Not analysed yet 4 May 2026
CVE-2026-24072 CVE record

CVSS 8.8 High

Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
- Apache Software Foundation Apache HTTP Server
- Privilege escalation
Not analysed yet 4 May 2026
CVE-2025-58098 CVE record

CVSS 8.3 High

Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
- Apache Software Foundation Apache HTTP Server
- Information disclosure
Not analysed yet 5 Dec 2025
CVE-2025-66200 CVE record

CVSS 5.4 Medium

Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo
- Apache Software Foundation Apache HTTP Server
- Authentication bypass
Not analysed yet 5 Dec 2025
CVE-2025-65082 CVE record

CVSS 6.5 Medium

Apache HTTP Server: CGI environment variable override
- Apache Software Foundation Apache HTTP Server
- CWE-150
Not analysed yet 5 Dec 2025
CVE-2025-59775 CVE record

CVSS 7.5 High

Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 5 Dec 2025
CVE-2025-55753 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_md (ACME), unintended retry intervals
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 5 Dec 2025
CVE-2025-54090 CVE record

CVSS 6.3 Medium

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
- Apache Software Foundation Apache HTTP Server
- CWE-253
Not analysed yet 23 Jul 2025
CVE-2025-53020 CVE record

CVSS 7.5 High

Apache HTTP Server: HTTP/2 DoS by Memory Increase
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 10 Jul 2025
CVE-2025-49812 CVE record

CVSS 7.4 High

Apache HTTP Server: mod_ssl TLS upgrade attack
- Apache Software Foundation Apache HTTP Server
- Authentication bypass
Not analysed yet 10 Jul 2025
CVE-2025-49630 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_proxy_http2 denial of service
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 10 Jul 2025
CVE-2025-23048 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache HTTP Server: mod_ssl access control bypass with session resumption
- Apache Software Foundation Apache HTTP Server
- Broken access control
Not analysed yet 10 Jul 2025
CVE-2024-43394 CVE record

CVSS 7.5 High

Apache HTTP Server: SSRF on Windows due to UNC paths
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 10 Jul 2025
CVE-2024-47252 CVE record

CVSS 7.5 High

Apache HTTP Server: mod_ssl error log variable escaping
- Apache Software Foundation Apache HTTP Server
- CWE-150
Not analysed yet 10 Jul 2025
CVE-2024-43204 CVE record

CVSS 7.5 High

Apache HTTP Server: SSRF with mod_headers setting Content-Type header
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 10 Jul 2025
CVE-2024-42516 CVE record

CVSS 7.5 High

Apache HTTP Server: HTTP response splitting
- Apache Software Foundation Apache HTTP Server
- CWE-20
Not analysed yet 10 Jul 2025
CVE-2024-40725 CVE record

CVSS 5.3 Medium

Apache HTTP Server: source code disclosure with handlers configured via AddType
- Apache Software Foundation Apache HTTP Server
- Information disclosure
Not analysed yet 18 Jul 2024
CVE-2024-40898 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 18 Jul 2024