# cve.now: Apache HTTP Server

The newest entries affecting Apache HTTP Server (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104150](https://cve.now/CVE-2026-104150.md): AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity (CVSS 8.7, adonisjs http-server · @adonisjs/http-server)
- [CVE-2026-107718](https://cve.now/CVE-2026-107718.md): AdonisJS: Unencoded route parameters can produce open redirects (CVSS 6.1, adonisjs http-server · @adonisjs/http-server)
- [CVE-2026-63686](https://cve.now/CVE-2026-63686.md): Apache HTTP Server: mod\_xml2enc crash on charset conversion failure (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-93546](https://cve.now/CVE-2026-93546.md): Apache HTTP Server: mod\_dav\_fs namespace overflow (CVSS 8.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-79768](https://cve.now/CVE-2026-79768.md): Apache HTTP Server: mod\_userdir information disclosure (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-73637](https://cve.now/CVE-2026-73637.md): Apache HTTP Server: mod\_auth\_digest DoS attack (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-73636](https://cve.now/CVE-2026-73636.md): Apache HTTP Server: mod\_auth\_digest one-time-nonce replay attack (CVSS 8.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-63718](https://cve.now/CVE-2026-63718.md): Apache HTTP Server: mod\_proxy\_uwsgi Transfer-Encoding response smuggling (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-63292](https://cve.now/CVE-2026-63292.md): Apache HTTP Server: mod\_vhost\_alias stack overflow (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-63045](https://cve.now/CVE-2026-63045.md): Apache HTTP Server: mod\_proxy\_ftp PASV address handling (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-59797](https://cve.now/CVE-2026-59797.md): Apache HTTP Server: mod\_ssl SSLRequire allows .htaccess ap\_expr file-function (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-59685](https://cve.now/CVE-2026-59685.md): Apache HTTP Server: Out-of-Bounds Write in ap\_directory\_walk() Canonical-Name Rewrite on CASE\_BLIND\_FILESYSTEM (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-58415](https://cve.now/CVE-2026-58415.md): Apache HTTP Server: mod\_dav\_fs property database read access (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-57941](https://cve.now/CVE-2026-57941.md): Apache HTTP Server: mod\_http2 use-after-free / wild write via shared session-\>bbtmp re-entrancy (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-56449](https://cve.now/CVE-2026-56449.md): Apache HTTP Server: mod\_proxy\_html: crash in dump\_content (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-56154](https://cve.now/CVE-2026-56154.md): Apache HTTP Server: mod\_rewrite use-after-free via %{LA-U:HTTP:...} (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-56153](https://cve.now/CVE-2026-56153.md): Apache HTTP Server: mod\_charset\_lite: Heap overflow in finish\_partial\_char (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-48005](https://cve.now/CVE-2026-48005.md): Apache HTTP Server: mod\_auth\_digest reauthentication attack (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-47360](https://cve.now/CVE-2026-47360.md): Apache HTTP Server: mod\_session: Session cookie not removed during internal redirect (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-46729](https://cve.now/CVE-2026-46729.md): Apache HTTP Server: mod\_heartmonitor denial of service (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-42356](https://cve.now/CVE-2026-42356.md): Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories (CVSS 3.7, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-42528](https://cve.now/CVE-2026-42528.md): Apache HTTP Server: mod\_dav shared lock overflow (CVSS 4.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-61526](https://cve.now/CVE-2026-61526.md): AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler (CVSS 6.1, adonisjs http-server)
- [CVE-2026-49975](https://cve.now/CVE-2026-49975.md): Apache HTTP Server: mod\_http2 denial of service (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-48913](https://cve.now/CVE-2026-48913.md): Apache HTTP Server: mod\_http2 memory corruption when file handles exhausted (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-42536](https://cve.now/CVE-2026-42536.md): Apache HTTP Server: mod\_xml2enc heap overflow (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-44185](https://cve.now/CVE-2026-44185.md): Apache HTTP Server: Stack Buffer Over-Read in mod\_ssl OCSP \`send\_request\` (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-34355](https://cve.now/CVE-2026-34355.md): Apache HTTP Server: mod\_proxy\_html buffer overflow (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-44631](https://cve.now/CVE-2026-44631.md): Apache HTTP Server: Heap Underflow in \`ap\_regname\` via Signed Char Overflow (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-44119](https://cve.now/CVE-2026-44119.md): Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules (CVSS 5.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-43951](https://cve.now/CVE-2026-43951.md): Apache HTTP Server: OOB Read in \`merge\_response\_headers\` can cause crash (CVSS 6.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-42535](https://cve.now/CVE-2026-42535.md): Apache HTTP Server: mod\_dav\_fs protected directory access (CVSS 9.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-34356](https://cve.now/CVE-2026-34356.md): Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-44186](https://cve.now/CVE-2026-44186.md): Apache HTTP Server: Loop in \`proxy\_ftp\_handler\` in mod\_proxy\_ftp (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-29170](https://cve.now/CVE-2026-29170.md): Apache HTTP Server: mod\_proxy\_ftp XSS (CVSS 6.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-29167](https://cve.now/CVE-2026-29167.md): Apache HTTP Server: mod\_ldap per-dir use-after-free (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-9170](https://cve.now/CVE-2026-9170.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 9.8, IBM HTTP Server)
- [CVE-2026-8835](https://cve.now/CVE-2026-8835.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 7.3, IBM HTTP Server)
- [CVE-2026-8834](https://cve.now/CVE-2026-8834.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 8.0, IBM HTTP Server)
- [CVE-2026-8855](https://cve.now/CVE-2026-8855.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 8.1, IBM HTTP Server)
- [CVE-2026-8854](https://cve.now/CVE-2026-8854.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 7.5, IBM HTTP Server)
- [CVE-2026-8856](https://cve.now/CVE-2026-8856.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 7.7, IBM HTTP Server)
- [CVE-2026-8852](https://cve.now/CVE-2026-8852.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 6.2, IBM HTTP Server)
- [CVE-2026-8850](https://cve.now/CVE-2026-8850.md): IBM HTTP Server is affected by multiple vulnerabilities (CVSS 7.5, IBM HTTP Server)
- [CVE-2026-28780](https://cve.now/CVE-2026-28780.md): Apache HTTP Server: buffer overflow in mod\_proxy\_ajp via ajp\_msg\_check\_header() (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-29168](https://cve.now/CVE-2026-29168.md): Apache HTTP Server: mod\_md unrestricted OCSP response (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-29169](https://cve.now/CVE-2026-29169.md): Apache HTTP Server: mod\_dav\_lock indirect lock crash (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-23918](https://cve.now/CVE-2026-23918.md): Apache HTTP Server: http2: double free and possible RCE on early reset (CVSS 8.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-33006](https://cve.now/CVE-2026-33006.md): Apache HTTP Server: mod\_auth\_digest timing attack (CVSS 4.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-33007](https://cve.now/CVE-2026-33007.md): Apache HTTP Server: mod\_authn\_socache crash (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-33523](https://cve.now/CVE-2026-33523.md): Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line (CVSS 6.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-33857](https://cve.now/CVE-2026-33857.md): Apache HTTP Server: Off-by-one OOB reads in AJP getter functions (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-34032](https://cve.now/CVE-2026-34032.md): Apache HTTP Server: mod\_proxy\_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp\_msg\_get\_string) (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-34059](https://cve.now/CVE-2026-34059.md): Apache HTTP Server: mod\_proxy\_ajp: Heap Over-Read and memory disclosure in ajp\_parse\_data() (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-24072](https://cve.now/CVE-2026-24072.md): Apache HTTP Server: mod\_rewrite elevation of privileges via ap\_expr (CVSS 8.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-40255](https://cve.now/CVE-2026-40255.md): @adonisjs/http-server has an Open Redirect vulnerability (CVSS 6.1, adonisjs http-server · adonisjs http-core +2)
- [CVE-2026-24469](https://cve.now/CVE-2026-24469.md): C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read (CVSS 7.5, frustratedProton http-server)
- [CVE-2025-58098](https://cve.now/CVE-2025-58098.md): Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVSS 8.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-66200](https://cve.now/CVE-2025-66200.md): Apache HTTP Server: mod\_userdir+suexec bypass via AllowOverride FileInfo (CVSS 5.4, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-65082](https://cve.now/CVE-2025-65082.md): Apache HTTP Server: CGI environment variable override (CVSS 6.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-59775](https://cve.now/CVE-2025-59775.md): Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-55753](https://cve.now/CVE-2025-55753.md): Apache HTTP Server: mod\_md (ACME), unintended retry intervals (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-54090](https://cve.now/CVE-2025-54090.md): Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64 (CVSS 6.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-53020](https://cve.now/CVE-2025-53020.md): Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-49812](https://cve.now/CVE-2025-49812.md): Apache HTTP Server: mod\_ssl TLS upgrade attack (CVSS 7.4, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-49630](https://cve.now/CVE-2025-49630.md): Apache HTTP Server: mod\_proxy\_http2 denial of service (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-23048](https://cve.now/CVE-2025-23048.md): Apache HTTP Server: mod\_ssl access control bypass with session resumption (CVSS 9.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-43394](https://cve.now/CVE-2024-43394.md): Apache HTTP Server: SSRF on Windows due to UNC paths (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-47252](https://cve.now/CVE-2024-47252.md): Apache HTTP Server: mod\_ssl error log variable escaping (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-43204](https://cve.now/CVE-2024-43204.md): Apache HTTP Server: SSRF with mod\_headers setting Content-Type header (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-42516](https://cve.now/CVE-2024-42516.md): Apache HTTP Server: HTTP response splitting (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-40725](https://cve.now/CVE-2024-40725.md): Apache HTTP Server: source code disclosure with handlers configured via AddType (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-40898](https://cve.now/CVE-2024-40898.md): Apache HTTP Server: SSRF with mod\_rewrite in server/vhost context on Windows (CVSS 9.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-39884](https://cve.now/CVE-2024-39884.md): Apache HTTP Server: source code disclosure with handlers configured via AddType (CVSS 6.2, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-39573](https://cve.now/CVE-2024-39573.md): Apache HTTP Server: mod\_rewrite proxy handler substitution (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38477](https://cve.now/CVE-2024-38477.md): Apache HTTP Server: Crash resulting in Denial of Service in mod\_proxy via a malicious request (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38476](https://cve.now/CVE-2024-38476.md): Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38475](https://cve.now/CVE-2024-38475.md): Apache HTTP Server weakness in mod\_rewrite when first segment of substitution matches filesystem path. (CVSS 9.1, KEV, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38474](https://cve.now/CVE-2024-38474.md): Apache HTTP Server weakness with encoded question marks in backreferences (CVSS 8.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38473](https://cve.now/CVE-2024-38473.md): Apache HTTP Server proxy encoding problem (CVSS 8.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38472](https://cve.now/CVE-2024-38472.md): Apache HTTP Server on WIndows UNC SSRF (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-36387](https://cve.now/CVE-2024-36387.md): Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVSS 5.4, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-20991](https://cve.now/CVE-2024-20991.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (CVSS 5.3, Oracle HTTP Server)
- [CVE-2024-27316](https://cve.now/CVE-2024-27316.md): Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-24795](https://cve.now/CVE-2024-24795.md): Apache HTTP Server: HTTP Response Splitting in multiple modules (CVSS 6.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2023-38709](https://cve.now/CVE-2023-38709.md): Apache HTTP Server: HTTP response splitting (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2023-31122](https://cve.now/CVE-2023-31122.md): Apache HTTP Server: mod\_macro buffer over-read (low (no CVSS), Apache Software Foundation Apache HTTP Server)
- [CVE-2023-43622](https://cve.now/CVE-2023-43622.md): Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 (low (no CVSS), Apache Software Foundation Apache HTTP Server)
- [CVE-2023-45802](https://cve.now/CVE-2023-45802.md): Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2023-22019](https://cve.now/CVE-2023-22019.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (CVSS 7.5, Oracle HTTP Server)
- [CVE-2014-125098](https://cve.now/CVE-2014-125098.md): Dart http\_server Directory Listing virtual\_directory.dart VirtualDirectory cross site scripting (CVSS 4.3, Dart http\_server)
- [CVE-2023-27522](https://cve.now/CVE-2023-27522.md): Apache HTTP Server: mod\_proxy\_uwsgi HTTP response splitting (CVSS 7.5, Apache Software Foundation Apache HTTP Server · uwsgi)
- [CVE-2023-25690](https://cve.now/CVE-2023-25690.md): Apache HTTP Server: HTTP request splitting with mod\_rewrite and mod\_proxy (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2023-26281](https://cve.now/CVE-2023-26281.md): IBM HTTP Server denial of service (CVSS 5.9, IBM HTTP Server)
- [CVE-2022-37436](https://cve.now/CVE-2022-37436.md): Apache HTTP Server: mod\_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-36760](https://cve.now/CVE-2022-36760.md): Apache HTTP Server: mod\_proxy\_ajp Possible request smuggling (CVSS 9.0, Apache Software Foundation Apache HTTP Server)
- [CVE-2006-20001](https://cve.now/CVE-2006-20001.md): Apache HTTP Server: mod\_dav out of bounds read, or write of zero byte (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-21593](https://cve.now/CVE-2022-21593.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). (CVSS 7.1, Oracle HTTP Server)
- [CVE-2022-31813](https://cve.now/CVE-2022-31813.md): mod\_proxy X-Forwarded-For dropped by hop-by-hop mechanism (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-30556](https://cve.now/CVE-2022-30556.md): Information Disclosure in mod\_lua with websockets (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-30522](https://cve.now/CVE-2022-30522.md): mod\_sed denial of service (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-29404](https://cve.now/CVE-2022-29404.md): Denial of service in mod\_lua r:parsebody (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-28615](https://cve.now/CVE-2022-28615.md): Read beyond bounds in ap\_strcmp\_match() (CVSS 9.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-28614](https://cve.now/CVE-2022-28614.md): read beyond bounds via ap\_rwrite() (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-28330](https://cve.now/CVE-2022-28330.md): read beyond bounds in mod\_isapi (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-26377](https://cve.now/CVE-2022-26377.md): mod\_proxy\_ajp: Possible request smuggling (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-23943](https://cve.now/CVE-2022-23943.md): mod\_sed: Read/write beyond bounds (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-22721](https://cve.now/CVE-2022-22721.md): core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-22720](https://cve.now/CVE-2022-22720.md): HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-22719](https://cve.now/CVE-2022-22719.md): mod\_lua Use of uninitialized value of in r:parsebody (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-20325](https://cve.now/CVE-2021-20325.md): Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit (no CVSS, httpd)
- [CVE-2021-44224](https://cve.now/CVE-2021-44224.md): Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-44790](https://cve.now/CVE-2021-44790.md): Possible buffer overflow when parsing multipart content in mod\_lua of Apache HTTP Server 2.4.51 and earlier (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-23797](https://cve.now/CVE-2021-23797.md): Directory Traversal (CVSS 7.5, http-server-node)
- [CVE-2021-35666](https://cve.now/CVE-2021-35666.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). (CVSS 5.9, Oracle HTTP Server)
- [CVE-2021-2480](https://cve.now/CVE-2021-2480.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (CVSS 3.7, Oracle HTTP Server)
- [CVE-2021-42013](https://cve.now/CVE-2021-42013.md): Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVSS 9.8, KEV, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-41773](https://cve.now/CVE-2021-41773.md): Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVSS 7.5, KEV, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-41524](https://cve.now/CVE-2021-41524.md): null pointer dereference in h2 fuzzing (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-40438](https://cve.now/CVE-2021-40438.md): mod\_proxy SSRF (CVSS 9.0, KEV, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-39275](https://cve.now/CVE-2021-39275.md): ap\_escape\_quotes buffer overflow (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-36160](https://cve.now/CVE-2021-36160.md): mod\_proxy\_uwsgi out of bound read (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-34798](https://cve.now/CVE-2021-34798.md): NULL pointer dereference in httpd core (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-33193](https://cve.now/CVE-2021-33193.md): Request splitting via HTTP/2 method injection and mod\_proxy (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-31618](https://cve.now/CVE-2021-31618.md): NULL pointer dereference on specially crafted HTTP/2 request (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-30641](https://cve.now/CVE-2021-30641.md): Unexpected URL matching with 'MergeSlashes OFF' (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-26691](https://cve.now/CVE-2021-26691.md): Apache HTTP Server mod\_session response handling heap overflow (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-26690](https://cve.now/CVE-2021-26690.md): mod\_session NULL pointer dereference (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2020-13950](https://cve.now/CVE-2020-13950.md): mod\_proxy\_http NULL pointer dereference (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2020-35452](https://cve.now/CVE-2020-35452.md): mod\_auth\_digest possible stack overflow by one nul byte (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2020-13938](https://cve.now/CVE-2020-13938.md): Improper Handling of Insufficient Privileges (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-17567](https://cve.now/CVE-2019-17567.md): mod\_proxy\_wstunnel tunneling of non Upgraded connections (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-2315](https://cve.now/CVE-2021-2315.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (CVSS 5.4, Oracle HTTP Server)
- [CVE-2020-11985](https://cve.now/CVE-2020-11985.md): IP address spoofing when proxying using mod\_remoteip and mod\_rewrite For configurations using proxying with mod\_remoteip and certain mod\_rew (no CVSS, Apache HTTP Server)
- [CVE-2020-11993](https://cve.now/CVE-2020-11993.md): Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, loggin (no CVSS, Apache HTTP Server)
- [CVE-2020-11984](https://cve.now/CVE-2020-11984.md): Apache HTTP server 2.4.32 to 2.4.44 mod\_proxy\_uwsgi info disclosure and possible RCE (no CVSS, Apache HTTP Server)
- [CVE-2020-9490](https://cve.now/CVE-2020-9490.md): Apache HTTP Server versions 2.4.20 to 2.4.43. (no CVSS, Apache HTTP Server)
- [CVE-2020-2952](https://cve.now/CVE-2020-2952.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (CVSS 6.5, Oracle HTTP Server)
- [CVE-2020-1927](https://cve.now/CVE-2020-1927.md): In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod\_rewrite that were intended to be self-referential might be fooled by en (no CVSS, Apache HTTP Server)
- [CVE-2020-1934](https://cve.now/CVE-2020-1934.md): In Apache HTTP Server 2.4.0 to 2.4.41, mod\_proxy\_ftp may use uninitialized memory when proxying to a malicious FTP server. (no CVSS, Apache HTTP Server)
- [CVE-2020-2530](https://cve.now/CVE-2020-2530.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (CVSS 6.1, Oracle HTTP Server)
- [CVE-2019-15600](https://cve.now/CVE-2019-15600.md): A Path traversal exists in http\_server which allows an attacker to read arbitrary system files. (no CVSS, http\_server)
- [CVE-2019-10082](https://cve.now/CVE-2019-10082.md): In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, (no CVSS, Apache HTTP Server)
- [CVE-2019-10097](https://cve.now/CVE-2019-10097.md): In Apache HTTP Server 2.4.32-2.4.39, when mod\_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, (no CVSS, Apache HTTP Server)
- [CVE-2019-10092](https://cve.now/CVE-2019-10092.md): In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod\_proxy error page. (no CVSS, Apache HTTP Server)
- [CVE-2019-10098](https://cve.now/CVE-2019-10098.md): In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod\_rewrite that were intended to be self-referential might be fooled by en (no CVSS, Apache HTTP Server)
- [CVE-2019-10081](https://cve.now/CVE-2019-10081.md): HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the (no CVSS, Apache HTTP Server)
- [CVE-2019-2751](https://cve.now/CVE-2019-2751.md): Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OHS Config MBeans). (no CVSS, Oracle HTTP Server)
- [CVE-2019-0197](https://cve.now/CVE-2019-0197.md): A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-0196](https://cve.now/CVE-2019-0196.md): A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-0220](https://cve.now/CVE-2019-0220.md): A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-0211](https://cve.now/CVE-2019-0211.md): In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or (CVSS 7.8, KEV, Apache HTTP Server)
- [CVE-2019-0217](https://cve.now/CVE-2019-0217.md): In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod\_auth\_digest when running in a threaded server could allow a user (no CVSS, Apache HTTP Server)
- [CVE-2019-0215](https://cve.now/CVE-2019-0215.md): In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod\_ssl when using per-location client certificate verification with TLSv1.3 (no CVSS, Apache HTTP Server)
- [CVE-2018-17189](https://cve.now/CVE-2018-17189.md): In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that re (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-17199](https://cve.now/CVE-2018-17199.md): In Apache HTTP Server 2.4 release 2.4.37 and prior, mod\_session checks the session expiry time before decoding the session. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-0190](https://cve.now/CVE-2019-0190.md): A bug exists in the way mod\_ssl handled client renegotiations. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-2414](https://cve.now/CVE-2019-2414.md): Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). (no CVSS, Oracle HTTP Server)
- [CVE-2018-11763](https://cve.now/CVE-2018-11763.md): In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-4975](https://cve.now/CVE-2016-4975.md): mod\_userdir CRLF injection (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-12171](https://cve.now/CVE-2017-12171.md): A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configurat (CVSS 6.5, Red Hat httpd)
- [CVE-2018-8011](https://cve.now/CVE-2018-8011.md): mod\_md, DoS via Coredumps on specially crafted requests (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-1333](https://cve.now/CVE-2018-1333.md): DoS for HTTP/2 connections by crafted requests (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-2760](https://cve.now/CVE-2018-2760.md): Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module). (no CVSS, Oracle HTTP Server)
- [CVE-2017-15710](https://cve.now/CVE-2017-15710.md): In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod\_authnz\_ldap, if configured with AuthLDAPCharsetConfig, uses the (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-15715](https://cve.now/CVE-2017-15715.md): In Apache httpd 2.4.0 to 2.4.29, the expression specified in \<FilesMatch\> could match '$' to a newline character in a malicious filename, ra (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-1283](https://cve.now/CVE-2018-1283.md): In Apache httpd 2.4.0 to 2.4.29, when mod\_session is configured to forward its session data to CGI applications (SessionEnv on, not the defa (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-1301](https://cve.now/CVE-2018-1301.md): A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size li (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-1302](https://cve.now/CVE-2018-1302.md): When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer po (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-1303](https://cve.now/CVE-2018-1303.md): A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-1312](https://cve.now/CVE-2018-1312.md): In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not co (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-2561](https://cve.now/CVE-2018-2561.md): Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). (no CVSS, Oracle HTTP Server)
- [CVE-2017-9798](https://cve.now/CVE-2017-9798.md): Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-0736](https://cve.now/CVE-2016-0736.md): In Apache HTTP Server versions 2.4.0 to 2.4.23, mod\_session\_crypto was encrypting its data/cookie using the configured ciphers with possibly (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-2161](https://cve.now/CVE-2016-2161.md): In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod\_auth\_digest can cause the server to crash, and each instance continue (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-8743](https://cve.now/CVE-2016-8743.md): Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response li (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-7659](https://cve.now/CVE-2017-7659.md): A maliciously constructed HTTP/2 request could cause mod\_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-9788](https://cve.now/CVE-2017-9788.md): In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in \[Proxy-\]Authorization headers of type 'Digest' was not initi (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-9789](https://cve.now/CVE-2017-9789.md): When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-3167](https://cve.now/CVE-2017-3167.md): In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap\_get\_basic\_auth\_pw() by third-party modules outside of the authent (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-3169](https://cve.now/CVE-2017-3169.md): In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod\_ssl may dereference a NULL pointer when third-party modules call ap\_hook\_pr (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-7668](https://cve.now/CVE-2017-7668.md): The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap\_find\_token() (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-7679](https://cve.now/CVE-2017-7679.md): In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod\_mime can read one byte past the end of a buffer when sending a malicious Co (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-8740](https://cve.now/CVE-2016-8740.md): The mod\_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict (no CVSS, Apache Software Foundation Apache HTTP Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/apache-httpd
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.