Apache HTTP Server security vulnerabilities
Web server. Public CVE monitoring for Apache HTTP Server. Vendor security advisories are linked on this page.
Built for Operators of this product.
42 public records · 0 security-fix timeline events. 0 published in the last 7 days. 29 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 8
- Medium 1
- Low 0
2026-08-0610 issues2026-11-03
Known exploited
View all known exploited- Critical9.1Apache HTTP Server Improper Escaping of Output VulnerabilityPatch nowKEVEPSS 99.96%Jul 1, 2024
- Critical9.0Apache HTTP Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 100.00%Sep 16, 2021
- Critical9.8Apache HTTP Server Path Traversal VulnerabilityPatch nowKEVEPSS 99.96%Oct 7, 2021
- High7.8Apache HTTP Server Privilege Escalation VulnerabilityPatch nowKEVEPSS 65.00%Apr 8, 2019
- Critical9.8Apache HTTP Server Path Traversal VulnerabilityPatch nowKEVEPSS 99.99%Sep 29, 2021
Recently published
Browse catalog- High8.8Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a dirCheck if you run itEPSS 0.43%Oct 1, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi respCheck if you run itEPSS 0.43%Oct 1, 2026
- High7.5A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of seCheck if you run itEPSS 0.46%Oct 1, 2026
- High7.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of serviceCheck if you run itEPSS 0.95%Oct 1, 2026
- High7.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configuratiCheck if you run itEPSS 0.44%Oct 1, 2026
- Critical9.8Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions.Check if you run itEPSS 0.49%Oct 1, 2026
- Medium5.3Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebCheck if you run itEPSS 0.46%Oct 1, 2026
- High7.5Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.Check if you run itEPSS 0.57%Oct 1, 2026
- High7.5Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.Check if you run itEPSS 0.46%Oct 1, 2026
- High7.5Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause aCheck if you run itEPSS 0.56%Oct 1, 2026