{"id":"CVE-2024-42516","aliases":["ALPINE-CVE-2024-42516","ALSA-2026:34109","ALSA-2026:41906","ALSA-2026:42828","AZL-65130","AZL-65139","AZL-65166","AZL-65214","BELL-CVE-2024-42516","BIT-apache-2024-42516","CLSA-2026-1772101256","CLSA-2026-1772101499","CLSA-2026-1772146785","CLSA-2026-1777945456","CLSA-2026-1777946314","DEBIAN-CVE-2024-42516","DLA-4270-1","EUVD-2024-54775","GHSA-5j7h-7m92-jgh4","MGASA-2025-0301","OESA-2025-2168","OESA-2025-2169","OESA-2025-2170","OESA-2025-2171","OESA-2025-2172","OESA-2025-2278","RHSA-2026:34109","RHSA-2026:41906","RHSA-2026:42828","RHSA-2026:47046","RHSA-2026:56868","RHSA-2026:62165","RHSA-2026:66323","RHSA-2026:67152","RLSA-2026:34109","RLSA-2026:41906","RLSA-2026:42828","ROOT-OS-DEBIAN-12-CVE-2024-42516","SUSE-SU-2025:02565-1","SUSE-SU-2025:02682-1","SUSE-SU-2025:02683-1","SUSE-SU-2025:02684-1","SUSE-SU-2025:02685-1","SUSE-SU-2026:21846-1","SUSE-SU-2026:2686-1","UBUNTU-CVE-2024-42516","USN-7639-1","USN-7639-2","USN-8338-1","openSUSE-SU-2025:15360-1","openSUSE-SU-2026:20810-1"],"status":"published","title":"Apache HTTP Server: HTTP response splitting","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00818,"percentile":0.57476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2025-07-10T16:53:13Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"httpd","fixed_in":["2.4.64-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"httpd","fixed_in":["2.4.64-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"apache2","fixed_in":["2.4.64-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.64"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"httpd","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"httpd-devel","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"httpd-manual","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"httpd-tools","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"mod_ldap","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"mod_proxy_html","fixed_in":["1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"mod_session","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"mod_ssl","fixed_in":["1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"httpd","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"httpd-devel","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"httpd-manual","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"httpd-tools","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"mod_ldap","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"mod_proxy_html","fixed_in":["1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"mod_session","fixed_in":["2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"mod_ssl","fixed_in":["1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"httpd","fixed_in":["2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"httpd-devel","fixed_in":["2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"httpd-manual","fixed_in":["2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"httpd-tools","fixed_in":["2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"mod_ldap","fixed_in":["2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"mod_proxy_html","fixed_in":["1:2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"mod_session","fixed_in":["2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"mod_ssl","fixed_in":["1:2.4.6-99.0.5.el7.centos.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.65-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.64-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.64-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apache2","fixed_in":["2.4.7-1ubuntu4.22+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache2","fixed_in":["2.4.18-2ubuntu3.17+esm16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"apache2","fixed_in":["2.4.29-1ubuntu4.27+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apache2","fixed_in":["2.4.41-4ubuntu3.23+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"apache2","fixed_in":["2.4.52-1ubuntu4.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"apache2","fixed_in":["2.4.58-1ubuntu8.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"apache2","fixed_in":["2.4.64-1ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.4"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-13.el9_8.5"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-10.module_el8.10.0+4233+8b7d9181.7"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module_el8.10.0+4088+57f011c1.2"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-65.module_el8.10.0+4233+8b7d9181.9"}]}],"bundled":10},{"source":"osv","ecosystem":"Azure Linux:2","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15.14-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.29-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.54-r2"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.63-r0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.56-r0"},{"fixed":"2.4.64-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.64"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7_9.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7.centos.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.53-11.el9_2.5.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1~deb12u1"}]}],"versions":["2.4.57-2","2.4.57-3","2.4.58-1","2.4.59-1","2.4.59-1~deb10u1","2.4.59-1~deb11u1","2.4.59-1~deb12u1","2.4.59-2","2.4.60-1","2.4.61-1","2.4.61-1~deb11u1","2.4.61-1~deb12u1","2.4.62-1","2.4.62-1~deb11u1","2.4.62-1~deb11u2","2.4.62-1~deb12u1","2.4.62-1~deb12u2","2.4.62-2","2.4.62-3","2.4.62-4","2.4.62-5","2.4.62-6","2.4.63-1","2.4.64-1","2.4.65-1~deb11u1"]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1~deb11u1"}]}],"versions":["2.4.48-3.1","2.4.48-3.1+deb11u1","2.4.48-4","2.4.49-1","2.4.49-1~bpo10+1","2.4.49-1~deb11u1","2.4.49-1~deb11u2","2.4.49-1~deb11u3","2.4.49-2","2.4.49-3","2.4.49-4","2.4.50-1","2.4.50-1~deb11u1","2.4.51-1","2.4.51-1~bpo10+1","2.4.51-1~bpo10+2","2.4.51-1~deb11u1","2.4.51-2","2.4.52-1","2.4.52-1~bpo10+1","2.4.52-1~deb11u1","2.4.52-1~deb11u2","2.4.52-2","2.4.52-3","2.4.53-1","2.4.53-1~deb11u1","2.4.53-2","2.4.53-2~bpo10+1","2.4.54-1","2.4.54-1~deb11u1","2.4.54-2","2.4.54-3","2.4.54-4","2.4.54-5","2.4.55-1","2.4.56-1","2.4.56-1~deb11u1","2.4.56-1~deb11u2","2.4.56-2","2.4.57-1","2.4.57-2","2.4.57-3","2.4.58-1","2.4.59-1","2.4.59-1~deb10u1","2.4.59-1~deb11u1","2.4.59-1~deb12u1","2.4.59-2","2.4.60-1","2.4.61-1","2.4.61-1~deb11u1","2.4.61-1~deb12u1","2.4.62-1","2.4.62-1~deb11u1","2.4.62-1~deb11u2","2.4.62-1~deb12u1","2.4.62-1~deb12u2","2.4.62-2","2.4.62-3","2.4.62-4","2.4.62-5","2.4.62-6","2.4.63-1","2.4.64-1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-28.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-25.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-25.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-10.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-10.oe2403sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-10.oe2403"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-1.el10_0.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-16.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.29-13.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.29-13.el8jbcs"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.6"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-11.el9_4.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-11.el9_4.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-11.el9_4.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-11.el9_4.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-11.el9_4.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.53-11.el9_2.15"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.53-11.el9_2.15"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.53-11.el9_2.15"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.53-11.el9_2.15"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.53-11.el9_2.15"}]}],"bundled":15},{"source":"osv","ecosystem":"Rocky Linux:10","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-13.el9_8.5"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+1984+1bed3124.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+40206+be2c8a50.8"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+40053+5a18018e.7"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+1830+22f0c9e0"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+1840+b070a976.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-65.module+el8.10.0+40197+0231e209.8"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+40204+716978aa.6"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+1775+6b057638"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+1830+22f0c9e0"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+40197+0231e209.5"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.10.0+40053+5a18018e.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.9.0+1370+89cc8ad5"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-35.69.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache2-tls13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-35.69.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-35.69.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache2-tls13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-35.69.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150400.6.46.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150200.3.82.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150200.3.82.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150200.3.82.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-150200.3.82.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"apache2-prefork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"apache2-event","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-event","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-prefork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-150600.5.35.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-150700.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache2-prefork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-150700.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apache2-event","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-150700.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-150700.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-150700.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-150700.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150400.6.57.1"}]}],"bundled":66},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.22+esm12"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4","2.4.7-1ubuntu4.1","2.4.7-1ubuntu4.4","2.4.7-1ubuntu4.5","2.4.7-1ubuntu4.6","2.4.7-1ubuntu4.7","2.4.7-1ubuntu4.8","2.4.7-1ubuntu4.9","2.4.7-1ubuntu4.10","2.4.7-1ubuntu4.11","2.4.7-1ubuntu4.13","2.4.7-1ubuntu4.15","2.4.7-1ubuntu4.16","2.4.7-1ubuntu4.17","2.4.7-1ubuntu4.18","2.4.7-1ubuntu4.19","2.4.7-1ubuntu4.20","2.4.7-1ubuntu4.21","2.4.7-1ubuntu4.22","2.4.7-1ubuntu4.22+esm1","2.4.7-1ubuntu4.22+esm2","2.4.7-1ubuntu4.22+esm3","2.4.7-1ubuntu4.22+esm4","2.4.7-1ubuntu4.22+esm5","2.4.7-1ubuntu4.22+esm6","2.4.7-1ubuntu4.22+esm8","2.4.7-1ubuntu4.22+esm9","2.4.7-1ubuntu4.22+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-2ubuntu3.17+esm16"}]}],"versions":["2.4.12-2ubuntu2","2.4.17-1ubuntu1","2.4.17-2ubuntu1","2.4.17-3ubuntu1","2.4.18-1ubuntu1","2.4.18-2ubuntu1","2.4.18-2ubuntu2","2.4.18-2ubuntu3","2.4.18-2ubuntu3.1","2.4.18-2ubuntu3.2","2.4.18-2ubuntu3.3","2.4.18-2ubuntu3.4","2.4.18-2ubuntu3.5","2.4.18-2ubuntu3.7","2.4.18-2ubuntu3.8","2.4.18-2ubuntu3.9","2.4.18-2ubuntu3.10","2.4.18-2ubuntu3.12","2.4.18-2ubuntu3.13","2.4.18-2ubuntu3.14","2.4.18-2ubuntu3.15","2.4.18-2ubuntu3.17","2.4.18-2ubuntu3.17+esm1","2.4.18-2ubuntu3.17+esm2","2.4.18-2ubuntu3.17+esm3","2.4.18-2ubuntu3.17+esm4","2.4.18-2ubuntu3.17+esm5","2.4.18-2ubuntu3.17+esm6","2.4.18-2ubuntu3.17+esm7","2.4.18-2ubuntu3.17+esm8","2.4.18-2ubuntu3.17+esm9","2.4.18-2ubuntu3.17+esm10","2.4.18-2ubuntu3.17+esm11","2.4.18-2ubuntu3.17+esm12","2.4.18-2ubuntu3.17+esm13","2.4.18-2ubuntu3.17+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+esm6"}]}],"versions":["2.4.27-2ubuntu3","2.4.29-1ubuntu1","2.4.29-1ubuntu2","2.4.29-1ubuntu3","2.4.29-1ubuntu4","2.4.29-1ubuntu4.1","2.4.29-1ubuntu4.2","2.4.29-1ubuntu4.3","2.4.29-1ubuntu4.4","2.4.29-1ubuntu4.5","2.4.29-1ubuntu4.6","2.4.29-1ubuntu4.7","2.4.29-1ubuntu4.8","2.4.29-1ubuntu4.10","2.4.29-1ubuntu4.11","2.4.29-1ubuntu4.12","2.4.29-1ubuntu4.13","2.4.29-1ubuntu4.14","2.4.29-1ubuntu4.16","2.4.29-1ubuntu4.17","2.4.29-1ubuntu4.18","2.4.29-1ubuntu4.19","2.4.29-1ubuntu4.20","2.4.29-1ubuntu4.21","2.4.29-1ubuntu4.22","2.4.29-1ubuntu4.23","2.4.29-1ubuntu4.24","2.4.29-1ubuntu4.25","2.4.29-1ubuntu4.26","2.4.29-1ubuntu4.27","2.4.29-1ubuntu4.27+esm1","2.4.29-1ubuntu4.27+esm2","2.4.29-1ubuntu4.27+esm3","2.4.29-1ubuntu4.27+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+esm2"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4","2.4.41-4ubuntu3.5","2.4.41-4ubuntu3.6","2.4.41-4ubuntu3.7","2.4.41-4ubuntu3.8","2.4.41-4ubuntu3.9","2.4.41-4ubuntu3.10","2.4.41-4ubuntu3.11","2.4.41-4ubuntu3.12","2.4.41-4ubuntu3.13","2.4.41-4ubuntu3.14","2.4.41-4ubuntu3.15","2.4.41-4ubuntu3.16","2.4.41-4ubuntu3.17","2.4.41-4ubuntu3.19","2.4.41-4ubuntu3.20","2.4.41-4ubuntu3.21","2.4.41-4ubuntu3.23"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1ubuntu4.15"}]}],"versions":["2.4.48-3.1ubuntu3","2.4.48-3.1ubuntu4","2.4.51-2ubuntu1","2.4.52-1ubuntu1","2.4.52-1ubuntu2","2.4.52-1ubuntu4","2.4.52-1ubuntu4.1","2.4.52-1ubuntu4.2","2.4.52-1ubuntu4.3","2.4.52-1ubuntu4.4","2.4.52-1ubuntu4.5","2.4.52-1ubuntu4.6","2.4.52-1ubuntu4.7","2.4.52-1ubuntu4.8","2.4.52-1ubuntu4.9","2.4.52-1ubuntu4.10","2.4.52-1ubuntu4.11","2.4.52-1ubuntu4.12","2.4.52-1ubuntu4.13","2.4.52-1ubuntu4.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1ubuntu8.7"}]}],"versions":["2.4.57-2ubuntu2","2.4.57-2ubuntu3","2.4.58-1ubuntu1","2.4.58-1ubuntu2","2.4.58-1ubuntu6","2.4.58-1ubuntu7","2.4.58-1ubuntu8","2.4.58-1ubuntu8.1","2.4.58-1ubuntu8.2","2.4.58-1ubuntu8.3","2.4.58-1ubuntu8.4","2.4.58-1ubuntu8.5","2.4.58-1ubuntu8.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-1ubuntu2"}]}],"versions":["2.4.63-1ubuntu1","2.4.63-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1ubuntu4.15"}]}],"versions":["2.4.48-3.1ubuntu3","2.4.48-3.1ubuntu4","2.4.51-2ubuntu1","2.4.52-1ubuntu1","2.4.52-1ubuntu2","2.4.52-1ubuntu4","2.4.52-1ubuntu4.1","2.4.52-1ubuntu4.2","2.4.52-1ubuntu4.3","2.4.52-1ubuntu4.4","2.4.52-1ubuntu4.5","2.4.52-1ubuntu4.6","2.4.52-1ubuntu4.7","2.4.52-1ubuntu4.8","2.4.52-1ubuntu4.9","2.4.52-1ubuntu4.10","2.4.52-1ubuntu4.11","2.4.52-1ubuntu4.12","2.4.52-1ubuntu4.13","2.4.52-1ubuntu4.14"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1ubuntu8.7"}]}],"versions":["2.4.57-2ubuntu2","2.4.57-2ubuntu3","2.4.58-1ubuntu1","2.4.58-1ubuntu2","2.4.58-1ubuntu6","2.4.58-1ubuntu7","2.4.58-1ubuntu8","2.4.58-1ubuntu8.1","2.4.58-1ubuntu8.2","2.4.58-1ubuntu8.3","2.4.58-1ubuntu8.4","2.4.58-1ubuntu8.5","2.4.58-1ubuntu8.6"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-2ubuntu3.17+esm16"}]}],"versions":["2.4.12-2ubuntu2","2.4.17-1ubuntu1","2.4.17-2ubuntu1","2.4.17-3ubuntu1","2.4.18-1ubuntu1","2.4.18-2ubuntu1","2.4.18-2ubuntu2","2.4.18-2ubuntu3","2.4.18-2ubuntu3.1","2.4.18-2ubuntu3.2","2.4.18-2ubuntu3.3","2.4.18-2ubuntu3.4","2.4.18-2ubuntu3.5","2.4.18-2ubuntu3.7","2.4.18-2ubuntu3.8","2.4.18-2ubuntu3.9","2.4.18-2ubuntu3.10","2.4.18-2ubuntu3.12","2.4.18-2ubuntu3.13","2.4.18-2ubuntu3.14","2.4.18-2ubuntu3.15","2.4.18-2ubuntu3.17","2.4.18-2ubuntu3.17+esm1","2.4.18-2ubuntu3.17+esm2","2.4.18-2ubuntu3.17+esm3","2.4.18-2ubuntu3.17+esm4","2.4.18-2ubuntu3.17+esm5","2.4.18-2ubuntu3.17+esm6","2.4.18-2ubuntu3.17+esm7","2.4.18-2ubuntu3.17+esm8","2.4.18-2ubuntu3.17+esm9","2.4.18-2ubuntu3.17+esm10","2.4.18-2ubuntu3.17+esm11","2.4.18-2ubuntu3.17+esm12","2.4.18-2ubuntu3.17+esm13","2.4.18-2ubuntu3.17+esm14"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+esm6"}]}],"versions":["2.4.27-2ubuntu3","2.4.29-1ubuntu1","2.4.29-1ubuntu2","2.4.29-1ubuntu3","2.4.29-1ubuntu4","2.4.29-1ubuntu4.1","2.4.29-1ubuntu4.2","2.4.29-1ubuntu4.3","2.4.29-1ubuntu4.4","2.4.29-1ubuntu4.5","2.4.29-1ubuntu4.6","2.4.29-1ubuntu4.7","2.4.29-1ubuntu4.8","2.4.29-1ubuntu4.10","2.4.29-1ubuntu4.11","2.4.29-1ubuntu4.12","2.4.29-1ubuntu4.13","2.4.29-1ubuntu4.14","2.4.29-1ubuntu4.16","2.4.29-1ubuntu4.17","2.4.29-1ubuntu4.18","2.4.29-1ubuntu4.19","2.4.29-1ubuntu4.20","2.4.29-1ubuntu4.21","2.4.29-1ubuntu4.22","2.4.29-1ubuntu4.23","2.4.29-1ubuntu4.24","2.4.29-1ubuntu4.25","2.4.29-1ubuntu4.26","2.4.29-1ubuntu4.27","2.4.29-1ubuntu4.27+esm1","2.4.29-1ubuntu4.27+esm2","2.4.29-1ubuntu4.27+esm3","2.4.29-1ubuntu4.27+esm4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+esm2"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4","2.4.41-4ubuntu3.5","2.4.41-4ubuntu3.6","2.4.41-4ubuntu3.7","2.4.41-4ubuntu3.8","2.4.41-4ubuntu3.9","2.4.41-4ubuntu3.10","2.4.41-4ubuntu3.11","2.4.41-4ubuntu3.12","2.4.41-4ubuntu3.13","2.4.41-4ubuntu3.14","2.4.41-4ubuntu3.15","2.4.41-4ubuntu3.16","2.4.41-4ubuntu3.17","2.4.41-4ubuntu3.19","2.4.41-4ubuntu3.20","2.4.41-4ubuntu3.21","2.4.41-4ubuntu3.23"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.22+esm12"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4","2.4.7-1ubuntu4.1","2.4.7-1ubuntu4.4","2.4.7-1ubuntu4.5","2.4.7-1ubuntu4.6","2.4.7-1ubuntu4.7","2.4.7-1ubuntu4.8","2.4.7-1ubuntu4.9","2.4.7-1ubuntu4.10","2.4.7-1ubuntu4.11","2.4.7-1ubuntu4.13","2.4.7-1ubuntu4.15","2.4.7-1ubuntu4.16","2.4.7-1ubuntu4.17","2.4.7-1ubuntu4.18","2.4.7-1ubuntu4.19","2.4.7-1ubuntu4.20","2.4.7-1ubuntu4.21","2.4.7-1ubuntu4.22","2.4.7-1ubuntu4.22+esm1","2.4.7-1ubuntu4.22+esm2","2.4.7-1ubuntu4.22+esm3","2.4.7-1ubuntu4.22+esm4","2.4.7-1ubuntu4.22+esm5","2.4.7-1ubuntu4.22+esm6","2.4.7-1ubuntu4.22+esm8","2.4.7-1ubuntu4.22+esm9","2.4.7-1ubuntu4.22+esm10"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-2ubuntu3.17+esm17"}]}],"versions":["2.4.12-2ubuntu2","2.4.17-1ubuntu1","2.4.17-2ubuntu1","2.4.17-3ubuntu1","2.4.18-1ubuntu1","2.4.18-2ubuntu1","2.4.18-2ubuntu2","2.4.18-2ubuntu3","2.4.18-2ubuntu3.1","2.4.18-2ubuntu3.2","2.4.18-2ubuntu3.3","2.4.18-2ubuntu3.4","2.4.18-2ubuntu3.5","2.4.18-2ubuntu3.7","2.4.18-2ubuntu3.8","2.4.18-2ubuntu3.9","2.4.18-2ubuntu3.10","2.4.18-2ubuntu3.12","2.4.18-2ubuntu3.13","2.4.18-2ubuntu3.14","2.4.18-2ubuntu3.15","2.4.18-2ubuntu3.17","2.4.18-2ubuntu3.17+esm1","2.4.18-2ubuntu3.17+esm2","2.4.18-2ubuntu3.17+esm3","2.4.18-2ubuntu3.17+esm4","2.4.18-2ubuntu3.17+esm5","2.4.18-2ubuntu3.17+esm6","2.4.18-2ubuntu3.17+esm7","2.4.18-2ubuntu3.17+esm8","2.4.18-2ubuntu3.17+esm9","2.4.18-2ubuntu3.17+esm10","2.4.18-2ubuntu3.17+esm11","2.4.18-2ubuntu3.17+esm12","2.4.18-2ubuntu3.17+esm13","2.4.18-2ubuntu3.17+esm14","2.4.18-2ubuntu3.17+esm16"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+esm7"}]}],"versions":["2.4.27-2ubuntu3","2.4.29-1ubuntu1","2.4.29-1ubuntu2","2.4.29-1ubuntu3","2.4.29-1ubuntu4","2.4.29-1ubuntu4.1","2.4.29-1ubuntu4.2","2.4.29-1ubuntu4.3","2.4.29-1ubuntu4.4","2.4.29-1ubuntu4.5","2.4.29-1ubuntu4.6","2.4.29-1ubuntu4.7","2.4.29-1ubuntu4.8","2.4.29-1ubuntu4.10","2.4.29-1ubuntu4.11","2.4.29-1ubuntu4.12","2.4.29-1ubuntu4.13","2.4.29-1ubuntu4.14","2.4.29-1ubuntu4.16","2.4.29-1ubuntu4.17","2.4.29-1ubuntu4.18","2.4.29-1ubuntu4.19","2.4.29-1ubuntu4.20","2.4.29-1ubuntu4.21","2.4.29-1ubuntu4.22","2.4.29-1ubuntu4.23","2.4.29-1ubuntu4.24","2.4.29-1ubuntu4.25","2.4.29-1ubuntu4.26","2.4.29-1ubuntu4.27","2.4.29-1ubuntu4.27+esm1","2.4.29-1ubuntu4.27+esm2","2.4.29-1ubuntu4.27+esm3","2.4.29-1ubuntu4.27+esm4","2.4.29-1ubuntu4.27+esm6"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+esm3"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4","2.4.41-4ubuntu3.5","2.4.41-4ubuntu3.6","2.4.41-4ubuntu3.7","2.4.41-4ubuntu3.8","2.4.41-4ubuntu3.9","2.4.41-4ubuntu3.10","2.4.41-4ubuntu3.11","2.4.41-4ubuntu3.12","2.4.41-4ubuntu3.13","2.4.41-4ubuntu3.14","2.4.41-4ubuntu3.15","2.4.41-4ubuntu3.16","2.4.41-4ubuntu3.17","2.4.41-4ubuntu3.19","2.4.41-4ubuntu3.20","2.4.41-4ubuntu3.21","2.4.41-4ubuntu3.23","2.4.41-4ubuntu3.23+esm2"],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.64-1.1"}]}],"bundled":8}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/10/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/10/3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42516","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5j7h-7m92-jgh4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-42516","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34109","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-42516","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29169","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34355","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34356","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44185","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44631","tags":["report"]},{"url":"https://bugzilla.redhat.com/2374549","tags":["report"]},{"url":"https://bugzilla.redhat.com/2465296","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486395","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486397","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486399","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486411","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486414","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-34109.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-24072.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-33006.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-42535.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-43951.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-44119.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-44186.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41906","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33006","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42535","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43951","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44119","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44186","tags":["report"]},{"url":"https://bugzilla.redhat.com/2464941","tags":["report"]},{"url":"https://bugzilla.redhat.com/2465293","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486402","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486406","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486415","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486416","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-41906.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42828","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-42828.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-42516","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1772101256.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1772101499.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1772146785.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777945456.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777946314.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42516.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42516","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0301.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34464","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/7","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/8","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/24/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2168","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49812","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2169","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2170","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2171","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2172","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2278","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2374549","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34109.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42516","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464941","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24072","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29169","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33006","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34355","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34356","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42535","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42536","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486415","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43951","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43951","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44119","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44185","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486402","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44186","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44631","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41906.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42828.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47046","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466913","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47046.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28780","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33007","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33857","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34032","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34032","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34059","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56868","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_5_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2374553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486419","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56868.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-43204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-43204","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29167","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29170","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29170","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48913","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62165","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62165.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66323","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66323.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67152","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67152.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:34109","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:41906","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:42828","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502565-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246169","tags":["report"]},{"url":"https://bugzilla.suse.com/1246302","tags":["report"]},{"url":"https://bugzilla.suse.com/1246303","tags":["report"]},{"url":"https://bugzilla.suse.com/1246305","tags":["report"]},{"url":"https://bugzilla.suse.com/1246306","tags":["report"]},{"url":"https://bugzilla.suse.com/1246307","tags":["report"]},{"url":"https://bugzilla.suse.com/1246477","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53020","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502682-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502683-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502684-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502685-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621846-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66200","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262686-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207327","tags":["report"]},{"url":"https://bugzilla.suse.com/1208708","tags":["report"]},{"url":"https://bugzilla.suse.com/1214357","tags":["report"]},{"url":"https://bugzilla.suse.com/1263935","tags":["report"]},{"url":"https://bugzilla.suse.com/1263950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263951","tags":["report"]},{"url":"https://bugzilla.suse.com/1263952","tags":["report"]},{"url":"https://bugzilla.suse.com/1263953","tags":["report"]},{"url":"https://bugzilla.suse.com/1263954","tags":["report"]},{"url":"https://bugzilla.suse.com/1263955","tags":["report"]},{"url":"https://bugzilla.suse.com/1263956","tags":["report"]},{"url":"https://bugzilla.suse.com/1263957","tags":["report"]},{"url":"https://bugzilla.suse.com/1264150","tags":["report"]},{"url":"https://bugzilla.suse.com/1264163","tags":["report"]},{"url":"https://bugzilla.suse.com/1267503","tags":["report"]},{"url":"https://bugzilla.suse.com/1267955","tags":["report"]},{"url":"https://bugzilla.suse.com/1267956","tags":["report"]},{"url":"https://bugzilla.suse.com/1267962","tags":["report"]},{"url":"https://bugzilla.suse.com/1267963","tags":["report"]},{"url":"https://bugzilla.suse.com/1267965","tags":["report"]},{"url":"https://bugzilla.suse.com/1267969","tags":["report"]},{"url":"https://bugzilla.suse.com/1267970","tags":["report"]},{"url":"https://bugzilla.suse.com/1267971","tags":["report"]},{"url":"https://bugzilla.suse.com/1267972","tags":["report"]},{"url":"https://bugzilla.suse.com/1267976","tags":["report"]},{"url":"https://bugzilla.suse.com/1267977","tags":["report"]},{"url":"https://bugzilla.suse.com/1267978","tags":["report"]},{"url":"https://bugzilla.suse.com/690734","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2006-20001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49975","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-42516","tags":["report"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-42516","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7639-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7639-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8338-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-43204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-49630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-49812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-53020","tags":["report"]},{"url":"https://launchpad.net/bugs/2119395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-55753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-58098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-65082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-66200","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43394","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-42516","title":"Apache HTTP Server: HTTP response splitting","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T16:53:13.201Z","modified":"2025-11-04T21:08:46.021Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:02.652467Z"}],"euvd":[{"id":"EUVD-2024-54775","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T16:53:13Z","modified":"2025-11-04T21:08:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:21.645169Z"}],"ghsa":[{"id":"GHSA-5j7h-7m92-jgh4","title":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate...","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T18:31:26Z","modified":"2025-11-05T00:31:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:04:38.82847Z"}],"nvd":[{"id":"CVE-2024-42516","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:45.343Z","modified":"2026-06-17T07:49:35.933Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"ALPINE-CVE-2024-42516","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:45.343Z","modified":"2026-11-02T11:17:50.106497703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-42516","status":"published","published":"2025-07-15T06:00:46.286272Z","modified":"2026-01-26T09:37:18.440843Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:20.200735Z"},{"id":"CVE-2024-42516","title":"Apache HTTP Server: HTTP response splitting","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T16:53:13.201Z","modified":"2026-10-28T02:30:28.758076156Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-42516","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.  This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.  Users are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:45.343Z","modified":"2026-11-02T12:02:59.77772214Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"OESA-2025-2168","title":"httpd security update","description":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nHTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)\n\nSSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)\n\nInsufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \u0026quot;%{varname}x\u0026quot; or \u0026quot;%{varname}c\u0026quot; to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)\n\nIn some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)\n\nIn some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \u0026quot;SSLEngine optional\u0026quot; to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:40.210958242Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2169","title":"httpd security update","description":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nHTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)\n\nSSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)\n\nInsufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \u0026quot;%{varname}x\u0026quot; or \u0026quot;%{varname}c\u0026quot; to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)\n\nIn some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)\n\nIn some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \u0026quot;SSLEngine optional\u0026quot; to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:09.909455813Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2170","title":"httpd security update","description":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nHTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)\n\nSSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)\n\nInsufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \u0026quot;%{varname}x\u0026quot; or \u0026quot;%{varname}c\u0026quot; to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)\n\nIn some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)\n\nIn some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \u0026quot;SSLEngine optional\u0026quot; to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:10.064148771Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2171","title":"httpd security update","description":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nHTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)\n\nSSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)\n\nInsufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \u0026quot;%{varname}x\u0026quot; or \u0026quot;%{varname}c\u0026quot; to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)\n\nIn some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)\n\nIn some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \u0026quot;SSLEngine optional\u0026quot; to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:10.071336504Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2172","title":"httpd security update","description":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nHTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)\n\nSSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)\n\nInsufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \u0026quot;%{varname}x\u0026quot; or \u0026quot;%{varname}c\u0026quot; to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)\n\nIn some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)\n\nIn some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \u0026quot;SSLEngine optional\u0026quot; to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:09.950534441Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2278","title":"httpd security update","description":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nHTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)\n\nSSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)\n\nInsufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \u0026quot;%{varname}x\u0026quot; or \u0026quot;%{varname}c\u0026quot; to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)\n\nIn some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)\n\nIn some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \u0026quot;SSLEngine optional\u0026quot; to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)","status":"published","published":"2025-09-12T11:09:21Z","modified":"2026-08-18T01:19:10.881091168Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2026:34109","title":"Red Hat Security Advisory: httpd security, bug fix, and enhancement update","status":"published","published":"2026-07-02T10:17:32Z","modified":"2026-10-15T10:17:12Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:41906","title":"Red Hat Security Advisory: httpd security, bug fix, and enhancement update","status":"published","published":"2026-07-23T10:13:45Z","modified":"2026-10-15T10:19:01Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:42828","title":"Red Hat Security Advisory: httpd:2.4 security, bug fix, and enhancement update","status":"published","published":"2026-07-23T10:14:14Z","modified":"2026-10-15T10:19:21Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:47046","title":"Red Hat Security Advisory: httpd security update","status":"published","published":"2026-07-29T10:11:28Z","modified":"2026-10-15T10:19:53Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:56868","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update","status":"published","published":"2026-08-27T10:15:14Z","modified":"2026-10-15T10:33:21.03518951Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:62165","title":"Red Hat Security Advisory: httpd security update","status":"published","published":"2026-09-02T10:22:22Z","modified":"2026-10-15T10:23:07Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:66323","title":"Red Hat Security Advisory: httpd security update","status":"published","published":"2026-09-11T10:15:00Z","modified":"2026-10-15T10:24:01Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67152","title":"Red Hat Security Advisory: httpd security update","status":"published","published":"2026-09-14T10:10:17Z","modified":"2026-10-15T10:24:18Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:34109","title":"Important: httpd security, bug fix, and enhancement update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.\n\nSecurity Fix(es):\n\n* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n\n* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n\n* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n\n* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n\n* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n\nBug Fix(es) and Enhancement(s):\n\n* address Moderate severity issues from httpd 2.4.68 [rhel-10.2.z] (JIRA:Rocky Linux-184518)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-07T12:05:23.118123Z","modified":"2026-07-07T12:30:04.86179333Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:41906","title":"Important: httpd security, bug fix, and enhancement update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.\n\nSecurity Fix(es):\n\n* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n\n* Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072)\n\n* httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)\n\n* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n\n* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n\n* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n\n* httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)\n\n* httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n\n* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n\n* httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)\n\n* httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges (CVE-2026-44119)\n\nBug Fix(es) and Enhancement(s):\n\n* address Moderate severity issues from httpd 2.4.68 [rhel-9.8.z] (JIRA:Rocky Linux-184520)\n\n* mod_proxy_html regression in CVE-2026-34355 fix [rhel-9.8.z] (JIRA:Rocky Linux-192752)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-22T12:03:41.8445Z","modified":"2026-07-22T12:30:05.662789678Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:42828","title":"Important: httpd:2.4 security, bug fix, and enhancement update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.\n\nSecurity Fix(es):\n\n* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n\n* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n\n* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n\n* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n\n* httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n\n* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n\n* httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)\n\nBug Fix(es) and Enhancement(s):\n\n* mod_proxy_html regression in CVE-2026-34355 fix [rhel-8.10.z] (JIRA:Rocky Linux-192751)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-21T18:01:06.762101Z","modified":"2026-07-21T18:34:58.318955866Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2024-42516","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:00Z","modified":"2026-05-29T10:59:17.874952536Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"ALSA-2026:34109","title":"Important: httpd security, bug fix, and enhancement update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  \n\nSecurity Fix(es):  \n\n  * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n  * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n  * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n  * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n  * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-01T00:00:00Z","modified":"2026-10-29T11:42:21.117027778Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:41906","title":"Important: httpd security, bug fix, and enhancement update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  \n\nSecurity Fix(es):  \n\n  * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n  * Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072)\n  * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)\n  * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n  * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n  * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n  * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)\n  * httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535)\n  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n  * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n  * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)\n  * httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges (CVE-2026-44119)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * address Moderate severity issues from httpd 2.4.68 [almalinux-9.8.z] (JIRA:AlmaLinux-184520)\n  * mod_proxy_html regression in CVE-2026-34355 fix [almalinux-9.8.z] (JIRA:AlmaLinux-192752)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-10-29T11:32:35.998149206Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:42828","title":"Important: httpd:2.4 security, bug fix, and enhancement update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  \n\nSecurity Fix(es):  \n\n  * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n  * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n  * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n  * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n  * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)\n  * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n  * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n  * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * mod_proxy_html regression in CVE-2026-34355 fix [almalinux-8.10.z] (JIRA:AlmaLinux-192751)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-21T00:00:00Z","modified":"2026-10-29T11:02:24.603096673Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-65130","title":"CVE-2024-42516 affecting package mod_http2 1.15.14-2","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:45Z","modified":"2026-04-21T04:37:30.813711Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-65139","title":"CVE-2024-42516 affecting package mod_http2 2.0.29-3","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:45Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.66471Z"},{"id":"AZL-65166","title":"CVE-2024-42516 affecting package httpd for versions less than 2.4.64-1","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:45Z","modified":"2026-04-21T04:37:31.270432Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-65214","title":"CVE-2024-42516 affecting package httpd for versions less than 2.4.64-1","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-10T17:15:45Z","modified":"2026-04-21T04:47:50.576943Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"BIT-apache-2024-42516","title":"Apache HTTP Server: HTTP response splitting","description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.","status":"published","published":"2025-07-16T07:55:45.463Z","modified":"2026-09-08T08:45:43.03726336Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2026-1772101256","title":"httpd: Fix of CVE-2024-42516","description":"- CVE-2024-42516: fix HTTP response splitting by reordering header validation\n  to occur after full response header assembly.","status":"published","published":"2026-02-26T10:21:00Z","modified":"2026-06-01T00:33:27.166284328Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1772101499","title":"httpd: Fix of CVE-2024-42516","description":"- CVE-2024-42516: fix HTTP response splitting by reordering header validation\n  to occur after full response header assembly.","status":"published","published":"2026-02-26T10:25:03Z","modified":"2026-06-01T00:33:28.172914993Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1772146785","title":"httpd: Fix of CVE-2024-42516","description":"- CVE-2024-42516: fix HTTP response splitting by reordering header validation\n  to occur after full response header assembly.","status":"published","published":"2026-02-26T22:59:49Z","modified":"2026-06-01T00:33:09.397382995Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1777945456","title":"httpd: Fix of 2 CVEs","description":"- CVE-2024-42516: fix HTTP response splitting in core httpd via header\n  merging refactor in modules/http/http_filters.c\n- CVE-2024-43204: fix SSRF in mod_proxy when mod_headers is configured to\n  modify Content-Type from request input","status":"published","published":"2026-05-05T01:44:21Z","modified":"2026-06-01T00:31:49.752570041Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1777946314","title":"httpd: Fix of 4 CVEs","description":"- CVE-2024-42516: fix HTTP response splitting in core via Content-Type response header (header_filter rewrite)\n- CVE-2024-43204: prevent SSRF via mod_headers RequestHeader set/edit Content-Type modifying response headers\n- CVE-2024-43394: expand UNC path checking with new ap_stat_check helper (Linux: defense-in-depth no-op);\n  fold in upstream fix for CVE-2025-54090 (RewriteCond expr always evaluating true regression)","status":"published","published":"2026-05-05T01:58:42Z","modified":"2026-06-01T00:32:51.113716089Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-4270-1","title":"apache2 - security update","status":"published","published":"2025-08-12T00:00:00Z","modified":"2026-03-09T02:11:17.49165Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0301","title":"Updated apache packages fix security vulnerabilities","description":"HTTP response splitting. (CVE-2024-42516)\nSSRF with mod_headers setting Content-Type header. (CVE-2024-43204)\nmod_ssl error log variable escaping. (CVE-2024-47252)\nmod_proxy_http2 denial of service. (CVE-2025-49630)\nmod_ssl access control bypass with session resumption. (CVE-2025-23048)\nmod_ssl TLS upgrade attack. (CVE-2025-49812)\nHTTP/2 DoS by Memory Increase. (CVE-2025-53020)\n'RewriteCond expr' always evaluates to true in 2.4.64. (CVE-2025-54090)\nYou will find the update delay sometimes causes a failure; just restart\nthe service after the update.\n","status":"published","published":"2025-11-18T02:47:26Z","modified":"2026-04-16T04:42:47.067838817Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15360-1","title":"apache2-2.4.64-1.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.64-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-20T00:00:00Z","modified":"2026-03-23T04:53:41.208916Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20810-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\nChanges in apache2:\n\nVersion update to 2.4.66 (jsc#PED-16181)\n\n  *) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec\n     bypass via AllowOverride FileInfo.\n     mod_userdir+suexec bypass via AllowOverride FileInfo\n     vulnerability in Apache HTTP Server. Users with access to use\n     the RequestHeader directive in htaccess can cause some CGI\n     scripts to run under an unexpected userid.\n     This issue affects Apache HTTP Server: from 2.4.7 through\n     2.4.65.\n  *) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment\n     variable override.\n     Improper Neutralization of Escape, Meta, or Control Sequences\n     vulnerability in Apache HTTP Server through environment\n     variables set via the Apache configuration unexpectedly\n     superseding variables calculated by the server for CGI programs.\n     This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.\n  *) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on\n     Windows through UNC SSRF.\n     Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP\n     Server on Windows with AllowEncodedSlashes On and MergeSlashes Off\n     allows to potentially leak NTLM hashes to a malicious server via\n     SSRF and malicious requests or\n     content\n  *) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side\n     Includes adds query string to #exec cmd=...\n     Apache HTTP Server 2.4.65 and earlier with Server Side Includes\n     (SSI) enabled and mod_cgid (but not mod_cgi) passes the\n     shell-escaped query string to #exec cmd=\"...\" directives.\n     This issue affects Apache HTTP Server before 2.4.66.\n  *) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),\n     unintended retry intervals\n     An integer overflow in the case of failed ACME certificate\n     renewal leads, after a number of failures (~30 days in default\n     configurations), to the backoff timer becoming 0. Attempts to\n     renew the certificate then are repeated without delays until it\n     succeeds.\n     This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.\n  *) mod_http2: Fix handling of 304 responses from mod_cache.\n  *) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of\n     integers, used in push diaries and proxy window size calculations.\n  *) mod_md: update to version 2.6.5\n     - New directive `MDInitialDelay`, controlling how longer to wait after\n       a server restart before checking certificates for renewal.\n       [Michael Kaufmann]\n     - Hardening: when build with OpenSSL older than 1.0.2 or old libressl\n       versions, the parsing of ASN.1 time strings did not do a length check.\n     - Hardening: when reading back OCSP responses stored in the local JSON\n       store, missing 'valid' key led to uninitialized values, resulting in\n       wrong refresh behaviour.\n  *) mod_md: update to version 2.6.6\n     - Fix a small memory leak when using OpenSSL's BIGNUMs.\n     - Fix reuse of curl easy handles by resetting them.\n  *) mod_http2: update to version 2.0.35\n     New directive `H2MaxStreamErrors` to control how much bad behaviour\n     by clients is tolerated before the connection is closed.\n  *) mod_proxy_http2: add support for ProxyErrorOverride directive.\n  *) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify\n     the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.\n  *) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual\n     host compatibility policy.\n  *) mod_md: update to version 2.6.2\n     - Fix error retry delay calculation to not already doubling the wait\n       on the first error.\n  *) mod_md: update to version 2.6.1\n     - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty\n       traffic on errored renewals for the ACME CA. This leads to error retries\n        of 30s, 1 minute, 2, 4, etc. up to daily attempts.\n     - Checking that configuring `MDRetryDelay` will result in a positive\n       duration. A delay of 0 is not accepted.\n     - Fix a bug in checking Content-Type of responses from the ACME server.\n     - Added ACME ARI support (rfc9773) to the module. Enabled by default. New\n       directive \"MDRenewViaARI on|off\" for controlling this.\n     - Removing tailscale support. It has not been working for a long time\n       as the company decided to change their APIs. Away with the dead code,\n       documentation and tests.\n     - Fixed a compilation issue with pre-industrial versions of libcurl.\n","status":"published","published":"2026-05-26T09:51:49Z","modified":"2026-05-29T18:24:10.323673705Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-42516","title":"CVE-2024-42516 in rootio-apache2 - Patched by Root","description":"Root has patched CVE-2024-42516 in the rootio-apache2 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:24:43Z","modified":"2026-06-19T14:01:11.903264978Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2025:02565-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2024-42516: Fixed HTTP response splitting. (bsc#1246477)\n- CVE-2024-43204: Fixed a SSRF when mod_proxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. (bsc#1246305)\n- CVE-2024-47252: Fixed insufficient escaping of user-supplied data in mod_ssl allows an untrusted SSL/TLS client to insert escape characters into log file. (bsc#1246303)\n- CVE-2025-23048: Fixed access control bypass by trusted clients through TLS 1.3 session resumption in some mod_ssl configurations. (bsc#1246302)\n- CVE-2025-49630: Fixed denial of service can be triggered by untrusted clients causing an assertion in mod_proxy_http2. (bsc#1246307)\n- CVE-2025-49812: Fixed Opossum Attack Application Layer Desynchronization using Opportunistic TLS. (bsc#1246169)\n- CVE-2025-53020: Fixed HTTP/2 denial of service due to late release of memory after effective lifetime. (bsc#1246306)\n","status":"published","published":"2025-07-31T06:27:04Z","modified":"2026-02-04T03:35:06.571401Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02682-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2024-42516: Fixed HTTP response splitting. (bsc#1246477)\n- CVE-2024-43204: Fixed a SSRF when mod_proxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. (bsc#1246305)\n- CVE-2024-47252: Fixed insufficient escaping of user-supplied data in mod_ssl allows an untrusted SSL/TLS client to insert escape characters into log file. (bsc#1246303)\n- CVE-2025-23048: Fixed access control bypass by trusted clients through TLS 1.3 session resumption in some mod_ssl configurations. (bsc#1246302)\n- CVE-2025-49630: Fixed denial of service can be triggered by untrusted clients causing an assertion in mod_proxy_http2. (bsc#1246307)\n- CVE-2025-49812: Fixed Opossum Attack Application Layer Desynchronization using Opportunistic TLS. (bsc#1246169)\n- CVE-2025-53020: Fixed HTTP/2 denial of service due to late release of memory after effective lifetime. (bsc#1246306)\n","status":"published","published":"2025-08-04T15:06:31Z","modified":"2026-03-23T04:47:50.454479Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02683-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2024-42516: Fixed HTTP response splitting. (bsc#1246477)\n- CVE-2024-43204: Fixed a SSRF when mod_proxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. (bsc#1246305)\n- CVE-2024-47252: Fixed insufficient escaping of user-supplied data in mod_ssl allows an untrusted SSL/TLS client to insert escape characters into log file. (bsc#1246303)\n- CVE-2025-23048: Fixed access control bypass by trusted clients through TLS 1.3 session resumption in some mod_ssl configurations. (bsc#1246302)\n- CVE-2025-49630: Fixed denial of service can be triggered by untrusted clients causing an assertion in mod_proxy_http2. (bsc#1246307)\n- CVE-2025-49812: Fixed Opossum Attack Application Layer Desynchronization using Opportunistic TLS. (bsc#1246169)\n- CVE-2025-53020: Fixed HTTP/2 denial of service due to late release of memory after effective lifetime. (bsc#1246306)\n","status":"published","published":"2025-08-04T15:06:58Z","modified":"2026-03-23T04:48:38.384089Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02684-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2024-42516: Fixed HTTP response splitting. (bsc#1246477)\n- CVE-2024-43204: Fixed a SSRF when mod_proxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. (bsc#1246305)\n- CVE-2024-47252: Fixed insufficient escaping of user-supplied data in mod_ssl allows an untrusted SSL/TLS client to insert escape characters into log file. (bsc#1246303)\n- CVE-2025-23048: Fixed access control bypass by trusted clients through TLS 1.3 session resumption in some mod_ssl configurations. (bsc#1246302)\n- CVE-2025-49630: Fixed denial of service can be triggered by untrusted clients causing an assertion in mod_proxy_http2. (bsc#1246307)\n- CVE-2025-49812: Fixed Opossum Attack Application Layer Desynchronization using Opportunistic TLS. (bsc#1246169)\n- CVE-2025-53020: Fixed HTTP/2 denial of service due to late release of memory after effective lifetime. (bsc#1246306)\n","status":"published","published":"2025-08-04T15:07:21Z","modified":"2026-03-23T04:47:50.893199Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02685-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2024-42516: Fixed HTTP response splitting. (bsc#1246477)\n- CVE-2024-43204: Fixed a SSRF when mod_proxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. (bsc#1246305)\n- CVE-2024-47252: Fixed insufficient escaping of user-supplied data in mod_ssl allows an untrusted SSL/TLS client to insert escape characters into log file. (bsc#1246303)\n- CVE-2025-23048: Fixed access control bypass by trusted clients through TLS 1.3 session resumption in some mod_ssl configurations. (bsc#1246302)\n- CVE-2025-49630: Fixed denial of service can be triggered by untrusted clients causing an assertion in mod_proxy_http2. (bsc#1246307)\n- CVE-2025-49812: Fixed Opossum Attack Application Layer Desynchronization using Opportunistic TLS. (bsc#1246169)\n- CVE-2025-53020: Fixed HTTP/2 denial of service due to late release of memory after effective lifetime. (bsc#1246306)\n","status":"published","published":"2025-08-04T15:08:14Z","modified":"2026-03-23T04:46:45.661111Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:21846-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\nChanges in apache2:\n\nVersion update to 2.4.66 (jsc#PED-16181)\n\n  *) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec\n     bypass via AllowOverride FileInfo.\n     mod_userdir+suexec bypass via AllowOverride FileInfo\n     vulnerability in Apache HTTP Server. Users with access to use\n     the RequestHeader directive in htaccess can cause some CGI\n     scripts to run under an unexpected userid.\n     This issue affects Apache HTTP Server: from 2.4.7 through\n     2.4.65.\n  *) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment\n     variable override.\n     Improper Neutralization of Escape, Meta, or Control Sequences\n     vulnerability in Apache HTTP Server through environment\n     variables set via the Apache configuration unexpectedly\n     superseding variables calculated by the server for CGI programs.\n     This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.\n  *) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on\n     Windows through UNC SSRF.\n     Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP\n     Server on Windows with AllowEncodedSlashes On and MergeSlashes Off\n     allows to potentially leak NTLM hashes to a malicious server via\n     SSRF and malicious requests or\n     content\n  *) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side\n     Includes adds query string to #exec cmd=...\n     Apache HTTP Server 2.4.65 and earlier with Server Side Includes\n     (SSI) enabled and mod_cgid (but not mod_cgi) passes the\n     shell-escaped query string to #exec cmd=\"...\" directives.\n     This issue affects Apache HTTP Server before 2.4.66.\n  *) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),\n     unintended retry intervals\n     An integer overflow in the case of failed ACME certificate\n     renewal leads, after a number of failures (~30 days in default\n     configurations), to the backoff timer becoming 0. Attempts to\n     renew the certificate then are repeated without delays until it\n     succeeds.\n     This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.\n  *) mod_http2: Fix handling of 304 responses from mod_cache.\n  *) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of\n     integers, used in push diaries and proxy window size calculations.\n  *) mod_md: update to version 2.6.5\n     - New directive `MDInitialDelay`, controlling how longer to wait after\n       a server restart before checking certificates for renewal.\n       [Michael Kaufmann]\n     - Hardening: when build with OpenSSL older than 1.0.2 or old libressl\n       versions, the parsing of ASN.1 time strings did not do a length check.\n     - Hardening: when reading back OCSP responses stored in the local JSON\n       store, missing 'valid' key led to uninitialized values, resulting in\n       wrong refresh behaviour.\n  *) mod_md: update to version 2.6.6\n     - Fix a small memory leak when using OpenSSL's BIGNUMs.\n     - Fix reuse of curl easy handles by resetting them.\n  *) mod_http2: update to version 2.0.35\n     New directive `H2MaxStreamErrors` to control how much bad behaviour\n     by clients is tolerated before the connection is closed.\n  *) mod_proxy_http2: add support for ProxyErrorOverride directive.\n  *) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify\n     the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.\n  *) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual\n     host compatibility policy.\n  *) mod_md: update to version 2.6.2\n     - Fix error retry delay calculation to not already doubling the wait\n       on the first error.\n  *) mod_md: update to version 2.6.1\n     - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty\n       traffic on errored renewals for the ACME CA. This leads to error retries\n        of 30s, 1 minute, 2, 4, etc. up to daily attempts.\n     - Checking that configuring `MDRetryDelay` will result in a positive\n       duration. A delay of 0 is not accepted.\n     - Fix a bug in checking Content-Type of responses from the ACME server.\n     - Added ACME ARI support (rfc9773) to the module. Enabled by default. New\n       directive \"MDRenewViaARI on|off\" for controlling this.\n     - Removing tailscale support. It has not been working for a long time\n       as the company decided to change their APIs. Away with the dead code,\n       documentation and tests.\n     - Fixed a compilation issue with pre-industrial versions of libcurl.\n","status":"published","published":"2026-05-26T09:46:21Z","modified":"2026-06-02T18:24:25.887555611Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2686-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues\n\n- CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).\n- CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).\n- CVE-2026-28780: heap buffer overflow in `mod_proxy_ajp` via `ajp_msg_check_header()` (bsc#1264163).\n- CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).\n- CVE-2026-29168: allocation of resources without limits in `mod_md` via OCSP response (bsc#1264150).\n- CVE-2026-29169: NULL pointer dereference in `mod_dav_lock` allows server crash via malicious requests (bsc#1263956).\n- CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).\n- CVE-2026-33006: `mod_auth_digest` timing attack allows bypass of Digest authentication (bsc#1263955).\n- CVE-2026-33007: NULL pointer dereference in `mod_authn_socache` allows unauthenticated remote user to crash a child\n  processes (bsc#1263954).\n- CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).\n- CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).\n- CVE-2026-34032: heap buffer overread in `mod_proxy_ajp` due to missing null-termination check (bsc#1263951).\n- CVE-2026-34059: heap buffer overread and memory disclosure via `ajp_parse_data()` (bsc#1263950).\n- CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).\n- CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).\n- CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).\n- CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).\n- CVE-2026-43951: out-of-bound read in `merge_response_headers` can cause crash (bsc#1267963).\n- CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).\n- CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (bsc#1267969).\n- CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of\n  service (bsc#1267970).\n- CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).\n- CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free\n  (bsc#1267972).\n- CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).\n\nNon security issue:\n\n- Update to 2.4.66 (jsc#PED-16334).\n","status":"published","published":"2026-06-29T22:36:03Z","modified":"2026-07-01T09:45:04.712117752Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-7639-1","title":"apache2 vulnerabilities","description":"It was discovered that the Apache HTTP Server incorrectly handled certain\nContent-Type response headers. A remote attacker could possibly use this\nissue to perform HTTP response splitting attacks. (CVE-2024-42516)\n\nxiaojunjie discovered that the Apache HTTP Server mod_proxy module\nincorrectly handled certain requests. A remote attacker could possibly use\nthis issue to send outbound proxy requests to an arbitrary URL.\n(CVE-2024-43204)\n\nJohn Runyon discovered that the Apache HTTP Server mod_ssl module\nincorrectly escaped certain data. A remote attacker could possibly use this\nissue to insert escape characters into log files. (CVE-2024-47252)\n\nSven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj\nSomorovsky discovered that the Apache HTTP Server mod_ssl module\nincorrectly handled TLS 1.3 session resumption. A remote attacker could\npossibly use this issue to bypass access control. (CVE-2025-23048)\n\nAnthony CORSIEZ discovered that the Apache HTTP Server mod_proxy_http2\nmodule incorrectly handled missing host headers. A remote attacker could\npossibly use this issue to cause the server to crash, resulting in a denial\nof service. (CVE-2025-49630)\n\nRobert Merget discovered that the Apache HTTP Server mod_ssl module\nincorrectly handled TLS upgrades. A remote attacker could possibly use this\nissue to hijack an HTTP session. This update removes the old \"SSLEngine\noptional\" configuration option, possibly requiring a configuration change\nin certain environments. (CVE-2025-49812)\n\nGal Bar Nahum discovered that the Apache HTTP Server incorrectly handled\ncertain memory operations. A remote attacker could possibly use this\nissue to cause the server to consume resources, leading to a denial of\nservice. (CVE-2025-53020)","status":"published","published":"2025-07-16T17:25:15Z","modified":"2026-04-27T18:17:06.183476036Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7639-2","title":"apache2 vulnerabilities","description":"USN-7639-1 fixed several vulnerabilities in Apache. This update\nprovides the corresponding update for Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and addressed a regression\nfix (LP: #2119395). CVE-2025-49630 and CVE-2025-53020 only\naffected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that the Apache HTTP Server incorrectly handled\n certain Content-Type response headers. A remote attacker could\n possibly use this issue to perform HTTP response splitting attacks.\n (CVE-2024-42516)\n\n xiaojunjie discovered that the Apache HTTP Server mod_proxy module\n incorrectly handled certain requests. A remote attacker could\n possibly use this issue to send outbound proxy requests to an\n arbitrary URL. (CVE-2024-43204)\n\n John Runyon discovered that the Apache HTTP Server mod_ssl module\n incorrectly escaped certain data. A remote attacker could possibly\n use this issue to insert escape characters into log files.\n (CVE-2024-47252)\n\n Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj\n Somorovsky discovered that the Apache HTTP Server mod_ssl module\n incorrectly handled TLS 1.3 session resumption. A remote attacker\n could possibly use this issue to bypass access control. (CVE-2025-23048)\n\n Anthony CORSIEZ discovered that the Apache HTTP Server mod_proxy_http2\n module incorrectly handled missing host headers. A remote attacker\n could possibly use this issue to cause the server to crash, resulting\n in a denial of service. (CVE-2025-49630)\n\n Robert Merget discovered that the Apache HTTP Server mod_ssl module\n incorrectly handled TLS upgrades. A remote attacker could possibly\n use this issue to hijack an HTTP session. This update removes the\n old \"SSLEngine optional\" configuration option, possibly requiring\n a configuration change in certain environments. (CVE-2025-49812)\n\n Gal Bar Nahum discovered that the Apache HTTP Server incorrectly\n handled certain memory operations. A remote attacker could possibly\n use this issue to cause the server to consume resources, leading\n to a denial of service. (CVE-2025-53020)\n","status":"published","published":"2025-08-19T10:40:27Z","modified":"2026-06-25T13:32:30.570329286Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-8338-1","title":"apache2 vulnerabilities","description":"It was discovered that Apache HTTP Server incorrectly handled certain\nresponse headers. An attacker could possibly use this issue to perform\nHTTP response splitting attacks. This issue only affected Ubuntu 14.04\nLTS. (CVE-2023-38709)\n\nWill Dormann and David Warren discovered that Apache HTTP Server's HTTP/2\nimplementation did not properly reclaim memory when streams were reset by\nclients. A remote attacker could possibly use this issue to cause Apache\nHTTP Server to consume resources, leading to a denial of service. This\nissue only affected Ubuntu 18.04 LTS. (CVE-2023-45802)\n\nKeran Mu and Jianjun Chen discovered that Apache HTTP Server incorrectly\nhandled certain response headers. An attacker could possibly use this issue\nto perform HTTP response splitting attacks. This issue only affected Ubuntu\n14.04 LTS. (CVE-2024-24795)\n\nOrange Tsai discovered that Apache HTTP Server mod_proxy incorrectly\nhandled URL encoding. A remote attacker could possibly use this issue to\nbypass authentication via crafted requests. This issue only affected\nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-38473)\n\nOrange Tsai discovered that Apache HTTP Server could be caused to perform\nserver-side request forgery (SSRF) via malicious backend response headers.\nA remote attacker could possibly use this issue to conduct SSRF attacks or\ndisclose sensitive information. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2024-38476)\n\nOrange Tsai discovered that Apache HTTP Server mod_proxy did not properly\nhandle certain null pointer conditions. A remote attacker could possibly use this\nissue to cause Apache HTTP Server to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38477)\n\nOrange Tsai discovered that Apache HTTP Server mod_rewrite could be made\nto perform server-side request forgery (SSRF) via unsafe RewriteRules. A\nremote attacker could possibly use this issue to conduct SSRF attacks. This\nissue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-39573)\n\nIt was discovered that Apache HTTP Server incorrectly handled certain\nresponse headers. An attacker could possibly use this issue to perform\nHTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2024-42516)\n\nIt was discovered that Apache HTTP Server could be caused to perform\nserver-side request forgery (SSRF) via mod_headers modifying Content-Type\nheaders. A remote attacker could possibly use this issue to conduct SSRF\nattacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-43204)\n\nJohn Runyon discovered that Apache HTTP Server mod_ssl did not properly\nescape user-supplied data before writing log entries. A remote attacker\ncould possibly use this issue to insert escape sequences into log files.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2024-47252)\n\nRobert Merget discovered that Apache HTTP Server with SSLEngine optional was\nvulnerable to HTTP desynchronisation attacks. An attacker in a privileged\nnetwork position could possibly use this issue to hijack HTTP sessions. This issue\nonly affected Ubuntu 14.04 LTS. (CVE-2025-49812)\n\nIt was discovered that Apache HTTP Server mod_md had an integer overflow in\nthe ACME certificate renewal backoff timer. An attacker could possibly use\nthis issue to cause excessive certificate renewal requests. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2025-55753)\n\nAnthony Parfenov discovered that Apache HTTP Server with SSI enabled and\nmod_cgid passed shell-escaped query strings to #exec cmd directives. A\nremote attacker could possibly use this issue to perform command injection.\n(CVE-2025-58098)\n\nMattias Åsander discovered that Apache HTTP Server incorrectly gave\nprecedence to environment variables from HTTP headers over server-calculated\nCGI variables. A remote attacker could possibly use this issue to influence\nthe environment of CGI programs. (CVE-2025-65082)\n\nMattias Åsander discovered that Apache HTTP Server mod_userdir with suexec\ncould be caused to run CGI scripts under an unexpected user ID via\nRequestHeader directives in .htaccess files. An attacker with .htaccess\nwrite access could possibly use this issue to bypass suexec user restrictions.\n(CVE-2025-66200)","status":"published","published":"2026-05-28T14:51:58Z","modified":"2026-05-29T10:59:16.96809627Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}