Apache HTTP Server vulnerabilities
The newest vulnerabilities affecting Apache HTTP Server, up to 200. Subscribe by RSS.
- CVE-2026-104150AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexityadonisjs http-server · @adonisjs/http-server
- CVE-2026-107718AdonisJS: Unencoded route parameters can produce open redirectsadonisjs http-server · @adonisjs/http-server
- CVE-2026-63686Apache HTTP Server: mod_xml2enc crash on charset conversion failureApache Software Foundation Apache HTTP Server
- CVE-2026-93546Apache HTTP Server: mod_dav_fs namespace overflowApache Software Foundation Apache HTTP Server
- CVE-2026-79768Apache HTTP Server: mod_userdir information disclosureApache Software Foundation Apache HTTP Server
- CVE-2026-73637Apache HTTP Server: mod_auth_digest DoS attackApache Software Foundation Apache HTTP Server
- CVE-2026-73636Apache HTTP Server: mod_auth_digest one-time-nonce replay attackApache Software Foundation Apache HTTP Server
- CVE-2026-63718Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smugglingApache Software Foundation Apache HTTP Server
- CVE-2026-63292Apache HTTP Server: mod_vhost_alias stack overflowApache Software Foundation Apache HTTP Server
- CVE-2026-63045Apache HTTP Server: mod_proxy_ftp PASV address handlingApache Software Foundation Apache HTTP Server
- CVE-2026-59797Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-functionApache Software Foundation Apache HTTP Server
- CVE-2026-59685Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEMApache Software Foundation Apache HTTP Server
- CVE-2026-58415Apache HTTP Server: mod_dav_fs property database read accessApache Software Foundation Apache HTTP Server
- CVE-2026-57941Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancyApache Software Foundation Apache HTTP Server
- CVE-2026-56449Apache HTTP Server: mod_proxy_html: crash in dump_contentApache Software Foundation Apache HTTP Server
- CVE-2026-56154Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}Apache Software Foundation Apache HTTP Server
- CVE-2026-56153Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_charApache Software Foundation Apache HTTP Server
- CVE-2026-48005Apache HTTP Server: mod_auth_digest reauthentication attackApache Software Foundation Apache HTTP Server
- CVE-2026-47360Apache HTTP Server: mod_session: Session cookie not removed during internal redirectApache Software Foundation Apache HTTP Server
- CVE-2026-46729Apache HTTP Server: mod_heartmonitor denial of serviceApache Software Foundation Apache HTTP Server
- CVE-2026-42356Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directoriesApache Software Foundation Apache HTTP Server
- CVE-2026-42528Apache HTTP Server: mod_dav shared lock overflowApache Software Foundation Apache HTTP Server
- CVE-2026-61526AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handleradonisjs http-server
- CVE-2026-49975Apache HTTP Server: mod_http2 denial of serviceApache Software Foundation Apache HTTP Server
- CVE-2026-48913Apache HTTP Server: mod_http2 memory corruption when file handles exhaustedApache Software Foundation Apache HTTP Server
- CVE-2026-42536Apache HTTP Server: mod_xml2enc heap overflowApache Software Foundation Apache HTTP Server
- CVE-2026-44185Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`Apache Software Foundation Apache HTTP Server
- CVE-2026-34355Apache HTTP Server: mod_proxy_html buffer overflowApache Software Foundation Apache HTTP Server
- CVE-2026-44631Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char OverflowApache Software Foundation Apache HTTP Server
- CVE-2026-44119Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modulesApache Software Foundation Apache HTTP Server
- CVE-2026-43951Apache HTTP Server: OOB Read in `merge_response_headers` can cause crashApache Software Foundation Apache HTTP Server
- CVE-2026-42535Apache HTTP Server: mod_dav_fs protected directory accessApache Software Foundation Apache HTTP Server
- CVE-2026-34356Apache HTTP Server: ProxyPassReverseCookieMap buffer overflowApache Software Foundation Apache HTTP Server
- CVE-2026-44186Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftpApache Software Foundation Apache HTTP Server
- CVE-2026-29170Apache HTTP Server: mod_proxy_ftp XSSApache Software Foundation Apache HTTP Server
- CVE-2026-29167Apache HTTP Server: mod_ldap per-dir use-after-freeApache Software Foundation Apache HTTP Server
- CVE-2026-9170IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-8835IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-8834IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-8855IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-8854IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-8856IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-8852IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-8850IBM HTTP Server is affected by multiple vulnerabilitiesIBM HTTP Server
- CVE-2026-28780Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()Apache Software Foundation Apache HTTP Server
- CVE-2026-29168Apache HTTP Server: mod_md unrestricted OCSP responseApache Software Foundation Apache HTTP Server
- CVE-2026-29169Apache HTTP Server: mod_dav_lock indirect lock crashApache Software Foundation Apache HTTP Server
- CVE-2026-23918Apache HTTP Server: http2: double free and possible RCE on early resetApache Software Foundation Apache HTTP Server
- CVE-2026-33006Apache HTTP Server: mod_auth_digest timing attackApache Software Foundation Apache HTTP Server
- CVE-2026-33007Apache HTTP Server: mod_authn_socache crashApache Software Foundation Apache HTTP Server
- CVE-2026-33523Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status lineApache Software Foundation Apache HTTP Server
- CVE-2026-33857Apache HTTP Server: Off-by-one OOB reads in AJP getter functionsApache Software Foundation Apache HTTP Server
- CVE-2026-34032Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)Apache Software Foundation Apache HTTP Server
- CVE-2026-34059Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()Apache Software Foundation Apache HTTP Server
- CVE-2026-24072Apache HTTP Server: mod_rewrite elevation of privileges via ap_exprApache Software Foundation Apache HTTP Server
- CVE-2026-40255@adonisjs/http-server has an Open Redirect vulnerabilityadonisjs http-server · adonisjs http-core +2
- CVE-2026-24469C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File ReadfrustratedProton http-server
- CVE-2025-58098Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...Apache Software Foundation Apache HTTP Server
- CVE-2025-66200Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfoApache Software Foundation Apache HTTP Server
- CVE-2025-65082Apache HTTP Server: CGI environment variable overrideApache Software Foundation Apache HTTP Server
- CVE-2025-59775Apache HTTP Server: NTLM Leakage on Windows through UNC SSRFApache Software Foundation Apache HTTP Server
- CVE-2025-55753Apache HTTP Server: mod_md (ACME), unintended retry intervalsApache Software Foundation Apache HTTP Server
- CVE-2025-54090Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64Apache Software Foundation Apache HTTP Server
- CVE-2025-53020Apache HTTP Server: HTTP/2 DoS by Memory IncreaseApache Software Foundation Apache HTTP Server
- CVE-2025-49812Apache HTTP Server: mod_ssl TLS upgrade attackApache Software Foundation Apache HTTP Server
- CVE-2025-49630Apache HTTP Server: mod_proxy_http2 denial of serviceApache Software Foundation Apache HTTP Server
- CVE-2025-23048Apache HTTP Server: mod_ssl access control bypass with session resumptionApache Software Foundation Apache HTTP Server
- CVE-2024-43394Apache HTTP Server: SSRF on Windows due to UNC pathsApache Software Foundation Apache HTTP Server
- CVE-2024-47252Apache HTTP Server: mod_ssl error log variable escapingApache Software Foundation Apache HTTP Server
- CVE-2024-43204Apache HTTP Server: SSRF with mod_headers setting Content-Type headerApache Software Foundation Apache HTTP Server
- CVE-2024-42516Apache HTTP Server: HTTP response splittingApache Software Foundation Apache HTTP Server
- CVE-2024-40725Apache HTTP Server: source code disclosure with handlers configured via AddTypeApache Software Foundation Apache HTTP Server
- CVE-2024-40898Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on WindowsApache Software Foundation Apache HTTP Server
- CVE-2024-39884Apache HTTP Server: source code disclosure with handlers configured via AddTypeApache Software Foundation Apache HTTP Server
- CVE-2024-39573Apache HTTP Server: mod_rewrite proxy handler substitutionApache Software Foundation Apache HTTP Server
- CVE-2024-38477Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious requestApache Software Foundation Apache HTTP Server
- CVE-2024-38476Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirectApache Software Foundation Apache HTTP Server
- CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.Apache Software Foundation Apache HTTP Server
- CVE-2024-38474Apache HTTP Server weakness with encoded question marks in backreferencesApache Software Foundation Apache HTTP Server
- CVE-2024-38473Apache HTTP Server proxy encoding problemApache Software Foundation Apache HTTP Server
- CVE-2024-38472Apache HTTP Server on WIndows UNC SSRFApache Software Foundation Apache HTTP Server
- CVE-2024-36387Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2Apache Software Foundation Apache HTTP Server
- CVE-2024-20991Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).Oracle HTTP Server
- CVE-2024-27316Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesApache Software Foundation Apache HTTP Server
- CVE-2024-24795Apache HTTP Server: HTTP Response Splitting in multiple modulesApache Software Foundation Apache HTTP Server
- CVE-2023-38709Apache HTTP Server: HTTP response splittingApache Software Foundation Apache HTTP Server
- CVE-2023-31122Apache HTTP Server: mod_macro buffer over-readApache Software Foundation Apache HTTP Server
- CVE-2023-43622Apache HTTP Server: DoS in HTTP/2 with initial windows size 0Apache Software Foundation Apache HTTP Server
- CVE-2023-45802Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RSTApache Software Foundation Apache HTTP Server
- CVE-2023-22019Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).Oracle HTTP Server
- CVE-2014-125098Dart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scriptingDart http_server
- CVE-2023-27522Apache HTTP Server: mod_proxy_uwsgi HTTP response splittingApache Software Foundation Apache HTTP Server · uwsgi
- CVE-2023-25690Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxyApache Software Foundation Apache HTTP Server
- CVE-2023-26281IBM HTTP Server denial of serviceIBM HTTP Server
- CVE-2022-37436Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splittingApache Software Foundation Apache HTTP Server
- CVE-2022-36760Apache HTTP Server: mod_proxy_ajp Possible request smugglingApache Software Foundation Apache HTTP Server
- CVE-2006-20001Apache HTTP Server: mod_dav out of bounds read, or write of zero byteApache Software Foundation Apache HTTP Server
- CVE-2022-21593Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans).Oracle HTTP Server
- CVE-2022-31813mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache Software Foundation Apache HTTP Server
- CVE-2022-30556Information Disclosure in mod_lua with websocketsApache Software Foundation Apache HTTP Server
- CVE-2022-30522mod_sed denial of serviceApache Software Foundation Apache HTTP Server
- CVE-2022-29404Denial of service in mod_lua r:parsebodyApache Software Foundation Apache HTTP Server
- CVE-2022-28615Read beyond bounds in ap_strcmp_match()Apache Software Foundation Apache HTTP Server
- CVE-2022-28614read beyond bounds via ap_rwrite()Apache Software Foundation Apache HTTP Server
- CVE-2022-28330read beyond bounds in mod_isapiApache Software Foundation Apache HTTP Server
- CVE-2022-26377mod_proxy_ajp: Possible request smugglingApache Software Foundation Apache HTTP Server
- CVE-2022-23943mod_sed: Read/write beyond boundsApache Software Foundation Apache HTTP Server
- CVE-2022-22721core: Possible buffer overflow with very large or unlimited LimitXMLRequestBodyApache Software Foundation Apache HTTP Server
- CVE-2022-22720HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlierApache Software Foundation Apache HTTP Server
- CVE-2022-22719mod_lua Use of uninitialized value of in r:parsebodyApache Software Foundation Apache HTTP Server
- CVE-2021-20325Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securithttpd
- CVE-2021-44224Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlierApache Software Foundation Apache HTTP Server
- CVE-2021-44790Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierApache Software Foundation Apache HTTP Server
- CVE-2021-23797Directory Traversalhttp-server-node
- CVE-2021-35666Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).Oracle HTTP Server
- CVE-2021-2480Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).Oracle HTTP Server
- CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)Apache Software Foundation Apache HTTP Server
- CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Apache Software Foundation Apache HTTP Server
- CVE-2021-41524null pointer dereference in h2 fuzzingApache Software Foundation Apache HTTP Server
- CVE-2021-40438mod_proxy SSRFApache Software Foundation Apache HTTP Server
- CVE-2021-39275ap_escape_quotes buffer overflowApache Software Foundation Apache HTTP Server
- CVE-2021-36160mod_proxy_uwsgi out of bound readApache Software Foundation Apache HTTP Server
- CVE-2021-34798NULL pointer dereference in httpd coreApache Software Foundation Apache HTTP Server
- CVE-2021-33193Request splitting via HTTP/2 method injection and mod_proxyApache Software Foundation Apache HTTP Server
- CVE-2021-31618NULL pointer dereference on specially crafted HTTP/2 requestApache Software Foundation Apache HTTP Server
- CVE-2021-30641Unexpected URL matching with 'MergeSlashes OFF'Apache Software Foundation Apache HTTP Server
- CVE-2021-26691Apache HTTP Server mod_session response handling heap overflowApache Software Foundation Apache HTTP Server
- CVE-2021-26690mod_session NULL pointer dereferenceApache Software Foundation Apache HTTP Server
- CVE-2020-13950mod_proxy_http NULL pointer dereferenceApache Software Foundation Apache HTTP Server
- CVE-2020-35452mod_auth_digest possible stack overflow by one nul byteApache Software Foundation Apache HTTP Server
- CVE-2020-13938Improper Handling of Insufficient PrivilegesApache Software Foundation Apache HTTP Server
- CVE-2019-17567mod_proxy_wstunnel tunneling of non Upgraded connectionsApache Software Foundation Apache HTTP Server
- CVE-2021-2315Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).Oracle HTTP Server
- CVE-2020-11985IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewApache HTTP Server
- CVE-2020-11993Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logginApache HTTP Server
- CVE-2020-11984Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCEApache HTTP Server
- CVE-2020-9490Apache HTTP Server versions 2.4.20 to 2.4.43.Apache HTTP Server
- CVE-2020-2952Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).Oracle HTTP Server
- CVE-2020-1927In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by enApache HTTP Server
- CVE-2020-1934In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.Apache HTTP Server
- CVE-2020-2530Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).Oracle HTTP Server
- CVE-2019-15600A Path traversal exists in http_server which allows an attacker to read arbitrary system files.http_server
- CVE-2019-10082In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed,Apache HTTP Server
- CVE-2019-10097In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol,Apache HTTP Server
- CVE-2019-10092In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.Apache HTTP Server
- CVE-2019-10098In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by enApache HTTP Server
- CVE-2019-10081HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the Apache HTTP Server
- CVE-2019-2751Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OHS Config MBeans).Oracle HTTP Server
- CVE-2019-0197A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.Apache Software Foundation Apache HTTP Server
- CVE-2019-0196A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.Apache Software Foundation Apache HTTP Server
- CVE-2019-0220A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.Apache Software Foundation Apache HTTP Server
- CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes orApache HTTP Server
- CVE-2019-0217In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a userApache HTTP Server
- CVE-2019-0215In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 Apache HTTP Server
- CVE-2018-17189In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that reApache Software Foundation Apache HTTP Server
- CVE-2018-17199In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session.Apache Software Foundation Apache HTTP Server
- CVE-2019-0190A bug exists in the way mod_ssl handled client renegotiations.Apache Software Foundation Apache HTTP Server
- CVE-2019-2414Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener).Oracle HTTP Server
- CVE-2018-11763In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPUApache Software Foundation Apache HTTP Server
- CVE-2016-4975mod_userdir CRLF injectionApache Software Foundation Apache HTTP Server
- CVE-2017-12171A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuratRed Hat httpd
- CVE-2018-8011mod_md, DoS via Coredumps on specially crafted requestsApache Software Foundation Apache HTTP Server
- CVE-2018-1333DoS for HTTP/2 connections by crafted requestsApache Software Foundation Apache HTTP Server
- CVE-2018-2760Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module).Oracle HTTP Server
- CVE-2017-15710In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Apache Software Foundation Apache HTTP Server
- CVE-2017-15715In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, raApache Software Foundation Apache HTTP Server
- CVE-2018-1283In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the defaApache Software Foundation Apache HTTP Server
- CVE-2018-1301A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size liApache Software Foundation Apache HTTP Server
- CVE-2018-1302When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer poApache Software Foundation Apache HTTP Server
- CVE-2018-1303A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while Apache Software Foundation Apache HTTP Server
- CVE-2018-1312In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not coApache Software Foundation Apache HTTP Server
- CVE-2018-2561Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener).Oracle HTTP Server
- CVE-2017-9798Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, oApache Software Foundation Apache HTTP Server
- CVE-2016-0736In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possiblyApache Software Foundation Apache HTTP Server
- CVE-2016-2161In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continueApache Software Foundation Apache HTTP Server
- CVE-2016-8743Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response liApache Software Foundation Apache HTTP Server
- CVE-2017-7659A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash Apache Software Foundation Apache HTTP Server
- CVE-2017-9788In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initiApache Software Foundation Apache HTTP Server
- CVE-2017-9789When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has beenApache Software Foundation Apache HTTP Server
- CVE-2017-3167In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentApache Software Foundation Apache HTTP Server
- CVE-2017-3169In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_prApache Software Foundation Apache HTTP Server
- CVE-2017-7668The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token()Apache Software Foundation Apache HTTP Server
- CVE-2017-7679In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious CoApache Software Foundation Apache HTTP Server
- CVE-2016-8740The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrictApache Software Foundation Apache HTTP Server