Apache HTTP Server vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
42 matching records
- High8.8Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a dirCheck if you run itEPSS 0.43%Oct 1, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi respCheck if you run itEPSS 0.43%Oct 1, 2026
- High7.5A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of seCheck if you run itEPSS 0.46%Oct 1, 2026
- High7.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of serviceCheck if you run itEPSS 0.95%Oct 1, 2026
- High7.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configuratiCheck if you run itEPSS 0.44%Oct 1, 2026
- Critical9.8Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions.Check if you run itEPSS 0.49%Oct 1, 2026
- Medium5.3Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebCheck if you run itEPSS 0.46%Oct 1, 2026
- High7.5Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.Check if you run itEPSS 0.57%Oct 1, 2026
- High7.5Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.Check if you run itEPSS 0.46%Oct 1, 2026
- High7.5Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause aCheck if you run itEPSS 0.56%Oct 1, 2026
- Critical9.8Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.Check if you run itEPSS 1.38%May 5, 2026
- High7.3Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data.Check if you run itEPSS 0.63%May 5, 2026
- Medium6.5HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.Check if you run itEPSS 0.44%May 4, 2026
- Medium5.3A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a cachin…Check if you run itEPSS 0.51%May 4, 2026
- Medium4.8A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.Check if you run itEPSS 0.56%May 4, 2026
- High7.5A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is…Check if you run itEPSS 0.59%May 4, 2026
- High8.8Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.Check this weekEPSS 49.73%May 4, 2026
- Medium5.3Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.Check if you run itEPSS 0.48%May 4, 2026
- Medium5.3Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server.Check if you run itEPSS 0.39%May 4, 2026
- High7.5Buffer Over-read vulnerability in Apache HTTP Server.Check if you run itEPSS 0.39%May 4, 2026
- High8.8An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.Check if you run itEPSS 0.65%May 4, 2026
- High8.3Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.Check if you run itEPSS 1.42%Dec 5, 2025
- Medium5.4mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server.Check if you run itEPSS 0.65%Dec 5, 2025
- Medium6.5Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly supersCheck if you run itEPSS 0.81%Dec 5, 2025
- High7.5Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicCheck if you run itEPSS 0.82%Dec 5, 2025