CVE-2012-0883medium · CVSS 6.9 — envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows lo
CVE-2012-2687low · CVSS 2.6 — Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in
CVE-2012-3499medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote at
CVE-2012-4558medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the
CVE-2013-5704medium · CVSS 5.0 — The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a head
CVE-2017-3169critical · CVSS 9.8 — In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_pr
CVE-2017-9798high · CVSS 7.5 — Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o
CVE-2016-4975medium · CVSS 6.1 — Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made i
CVE-2021-34798high · CVSS 7.5 — Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-39275critical · CVSS 9.8 — ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functio
CVE-2021-40438critical · CVSS 9.0 — A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apa
CVE-2021-44790critical · CVSS 9.8 — A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Ap
CVE-2022-22719high · CVSS 7.5 — A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache
CVE-2022-22720critical · CVSS 9.8 — Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing th
CVE-2022-22721critical · CVSS 9.1 — If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which
CVE-2022-28330medium · CVSS 5.3 — Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
CVE-2022-28614medium · CVSS 5.3 — The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect
CVE-2022-28615critical · CVSS 9.1 — Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with
CVE-2022-29404high · CVSS 7.5 — In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to
CVE-2022-30556high · CVSS 7.5 — Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated
CVE-2022-31813critical · CVSS 9.8 — Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop
CVE-2006-20001high · CVSS 7.5 — A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the
CVE-2022-37436medium · CVSS 5.3 — Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers bein
CVE-2023-31122high · CVSS 7.5 — Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
CVE-2023-38709high · CVSS 7.3 — Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.
This issu
CVE-2024-40898high · CVSS 7.5 — SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server
CVE-2025-49812high · CVSS 7.4 — In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle
CVE-2025-58098high · CVSS 8.3 — Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query
CVE-2026-24072high · CVSS 8.8 — An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the pr
CVE-2026-34059high · CVSS 7.5 — Buffer Over-read vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgr
CVE-2026-33857medium · CVSS 5.3 — Out-of-bounds Read vulnerability in mod_proxy_ajp of
Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users ar
CVE-2026-34032medium · CVSS 5.3 — Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
CVE-2026-29169high · CVSS 7.5 — A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicio
CVE-2026-33006medium · CVSS 4.8 — A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.
Users a
CVE-2026-28780critical · CVSS 9.8 — Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.
If mod_proxy_ajp connects to a malicious AJP server this AJ
CVE-2026-29170medium · CVSS 6.1 — A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when
CVE-2026-42535critical · CVSS 9.1 — A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property