Advisories · Technology

Apache Software Foundation Apache HTTP Server.

Every CVE that names Apache Software Foundation Apache HTTP Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-39884 CVE record

CVSS 6.2 Medium

Apache HTTP Server: source code disclosure with handlers configured via AddType
- Apache Software Foundation Apache HTTP Server
Not analysed yet 4 Jul 2024
CVE-2024-39573 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Apache HTTP Server: mod_rewrite proxy handler substitution
- Apache Software Foundation Apache HTTP Server
- CWE-20
Not analysed yet 1 Jul 2024
CVE-2024-38477 CVE record

CVSS 7.5 High

Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Jul 2024
CVE-2024-38476 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
- Apache Software Foundation Apache HTTP Server
- CWE-829
Not analysed yet 1 Jul 2024
CVE-2024-38475 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
- Apache Software Foundation Apache HTTP Server
- CWE-116
Not analysed yet 1 Jul 2024
CVE-2024-38474 CVE record

CVSS 8.1 High

Apache HTTP Server weakness with encoded question marks in backreferences
- Apache Software Foundation Apache HTTP Server
- CWE-116
Not analysed yet 1 Jul 2024
CVE-2024-38473 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

Apache HTTP Server proxy encoding problem
- Apache Software Foundation Apache HTTP Server
- CWE-116
Not analysed yet 1 Jul 2024
CVE-2024-38472 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Apache HTTP Server on WIndows UNC SSRF
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 1 Jul 2024
CVE-2024-36387 CVE record

CVSS 5.4 Medium

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 1 Jul 2024
CVE-2024-27316 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 4 Apr 2024
CVE-2024-24795 CVE record

CVSS 6.3 Medium

Apache HTTP Server: HTTP Response Splitting in multiple modules
- Apache Software Foundation Apache HTTP Server
- Other injection
- HTTP request smuggling
Not analysed yet 4 Apr 2024
CVE-2023-38709 CVE record

CVSS 7.3 High

Apache HTTP Server: HTTP response splitting
- Apache Software Foundation Apache HTTP Server
- CWE-1284
Not analysed yet 4 Apr 2024
CVE-2023-31122 CVE record

Apache HTTP Server: mod_macro buffer over-read
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 23 Oct 2023
CVE-2023-43622 CVE record

Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 23 Oct 2023
CVE-2023-45802 CVE record

Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 23 Oct 2023
CVE-2023-25690 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
- Apache Software Foundation Apache HTTP Server
- HTTP request smuggling
Not analysed yet 7 Mar 2023
CVE-2022-37436 CVE record

CVSS 5.3 Medium

Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
- Apache Software Foundation Apache HTTP Server
- Other injection
Not analysed yet 17 Jan 2023
CVE-2022-36760 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Apache HTTP Server: mod_proxy_ajp Possible request smuggling
- Apache Software Foundation Apache HTTP Server
- HTTP request smuggling
Not analysed yet 17 Jan 2023
CVE-2006-20001 CVE record

Apache HTTP Server: mod_dav out of bounds read, or write of zero byte
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 17 Jan 2023
CVE-2022-31813 CVE record

mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
- Apache Software Foundation Apache HTTP Server
- CWE-348
Not analysed yet 8 Jun 2022
CVE-2022-30556 CVE record

Information Disclosure in mod_lua with websockets
- Apache Software Foundation Apache HTTP Server
- Information disclosure
Not analysed yet 8 Jun 2022
CVE-2022-30522 CVE record

mod_sed denial of service
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 8 Jun 2022
CVE-2022-29404 CVE record

Denial of service in mod_lua r:parsebody
- Apache Software Foundation Apache HTTP Server
- Denial of service
Not analysed yet 8 Jun 2022
CVE-2022-28615 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Read beyond bounds in ap_strcmp_match()
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2022
CVE-2022-28614 CVE record

read beyond bounds via ap_rwrite()
- Apache Software Foundation Apache HTTP Server
- Memory corruption
- Information disclosure
Not analysed yet 8 Jun 2022
CVE-2022-28330 CVE record

read beyond bounds in mod_isapi
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 8 Jun 2022
CVE-2022-26377 CVE record

mod_proxy_ajp: Possible request smuggling
- Apache Software Foundation Apache HTTP Server
- HTTP request smuggling
Not analysed yet 8 Jun 2022
CVE-2022-23943 CVE record

mod_sed: Read/write beyond bounds
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 14 Mar 2022
CVE-2022-22721 CVE record

core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 14 Mar 2022
CVE-2022-22720 CVE record

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
- Apache Software Foundation Apache HTTP Server
- HTTP request smuggling
Not analysed yet 14 Mar 2022
CVE-2022-22719 CVE record

mod_lua Use of uninitialized value of in r:parsebody
- Apache Software Foundation Apache HTTP Server
- CWE-665
Not analysed yet 14 Mar 2022
CVE-2021-44224 CVE record

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 20 Dec 2021
CVE-2021-44790 CVE record

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 20 Dec 2021
CVE-2021-42013 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
- Apache Software Foundation Apache HTTP Server
- Path traversal
Not analysed yet 7 Oct 2021
CVE-2021-41773 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
- Apache Software Foundation Apache HTTP Server
- Path traversal
Not analysed yet 5 Oct 2021
CVE-2021-41524 CVE record

null pointer dereference in h2 fuzzing
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 5 Oct 2021
CVE-2021-40438 CVE record

CVSS 9.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

mod_proxy SSRF
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 16 Sept 2021
CVE-2021-39275 CVE record

ap_escape_quotes buffer overflow
- Apache Software Foundation Apache HTTP Server
Not analysed yet 16 Sept 2021
CVE-2021-36160 CVE record

mod_proxy_uwsgi out of bound read
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 16 Sept 2021
CVE-2021-34798 CVE record

NULL pointer dereference in httpd core
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 16 Sept 2021
CVE-2021-33193 CVE record

Request splitting via HTTP/2 method injection and mod_proxy
- Apache Software Foundation Apache HTTP Server
Not analysed yet 16 Aug 2021
CVE-2021-31618 CVE record

NULL pointer dereference on specially crafted HTTP/2 request
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 15 Jun 2021
CVE-2021-30641 CVE record

Unexpected URL matching with 'MergeSlashes OFF'
- Apache Software Foundation Apache HTTP Server
Not analysed yet 10 Jun 2021
CVE-2021-26691 CVE record

Apache HTTP Server mod_session response handling heap overflow
- Apache Software Foundation Apache HTTP Server
- Memory corruption
Not analysed yet 10 Jun 2021
CVE-2021-26690 CVE record

mod_session NULL pointer dereference
- Apache Software Foundation Apache HTTP Server
Not analysed yet 10 Jun 2021
CVE-2020-35452 CVE record

mod_auth_digest possible stack overflow by one nul byte
- Apache Software Foundation Apache HTTP Server
Not analysed yet 10 Jun 2021
CVE-2020-13950 CVE record

mod_proxy_http NULL pointer dereference
- Apache Software Foundation Apache HTTP Server
Not analysed yet 10 Jun 2021
CVE-2020-13938 CVE record

Improper Handling of Insufficient Privileges
- Apache Software Foundation Apache HTTP Server
Not analysed yet 10 Jun 2021
CVE-2019-17567 CVE record

mod_proxy_wstunnel tunneling of non Upgraded connections
- Apache Software Foundation Apache HTTP Server
Not analysed yet 10 Jun 2021
CVE-2019-0197 CVE record

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.
- Apache Software Foundation Apache HTTP Server
Not analysed yet 11 Jun 2019
CVE-2019-0196 CVE record

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.
- Apache Software Foundation Apache HTTP Server
Not analysed yet 11 Jun 2019
CVE-2019-0220 CVE record

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.
- Apache Software Foundation Apache HTTP Server
Not analysed yet 11 Jun 2019
CVE-2019-0190 CVE record

A bug exists in the way mod_ssl handled client renegotiations.
- Apache Software Foundation Apache HTTP Server
Not analysed yet 30 Jan 2019
CVE-2018-17199 CVE record

Apache Software Foundation Apache HTTP Server: In Apache HTTP Server 2.4 release 2.4.37 and prior…
- Apache Software Foundation Apache HTTP Server
Not analysed yet 30 Jan 2019
CVE-2018-17189 CVE record

Apache Software Foundation Apache HTTP Server: In Apache HTTP server versions 2.4.37 and prior…
- Apache Software Foundation Apache HTTP Server
Not analysed yet 30 Jan 2019
CVE-2018-11763 CVE record

Apache Software Foundation Apache HTTP Server: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous…
- Apache Software Foundation Apache HTTP Server
Not analysed yet 25 Sept 2018
CVE-2016-4975 CVE record

mod_userdir CRLF injection
- Apache Software Foundation Apache HTTP Server
Not analysed yet 14 Aug 2018
CVE-2018-8011 CVE record

mod_md, DoS via Coredumps on specially crafted requests
- Apache Software Foundation Apache HTTP Server
Not analysed yet 18 Jul 2018
CVE-2018-1333 CVE record

DoS for HTTP/2 connections by crafted requests
- Apache Software Foundation Apache HTTP Server
Not analysed yet 18 Jun 2018
CVE-2018-1312 CVE record

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed.
- Apache Software Foundation Apache HTTP Server
Not analysed yet 26 Mar 2018