Apache Http Server vulnerabilities

• apache http server Apache HTTP Server: mod_xml2enc crash on charset conversion failure CVE-2026-63686 Public exploitFix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_dav_fs namespace overflow CVE-2026-93546 Fix available 8.8 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_userdir information disclosure CVE-2026-79768 Fix available 5.3 MediumOctober 1, 2026
• apache http server Apache HTTP Server: mod_auth_digest DoS attack CVE-2026-73637 Fix available 7.3 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_auth_digest one-time-nonce replay attack CVE-2026-73636 Fix available 8.1 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling CVE-2026-63718 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_vhost_alias stack overflow CVE-2026-63292 Public exploitFix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_proxy_ftp PASV address handling CVE-2026-63045 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function CVE-2026-59797 Fix available 9.8 CriticalOctober 1, 2026
• apache http server Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM CVE-2026-59685 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_dav_fs property database read access CVE-2026-58415 Fix available 5.3 MediumOctober 1, 2026
• apache http server Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy CVE-2026-57941 Fix available 9.8 CriticalOctober 1, 2026
• apache http server Apache HTTP Server: mod_proxy_html: crash in dump_content CVE-2026-56449 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} CVE-2026-56154 Fix available 9.8 CriticalOctober 1, 2026
• apache http server Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char CVE-2026-56153 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_auth_digest reauthentication attack CVE-2026-48005 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_session: Session cookie not removed during internal redirect CVE-2026-47360 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: mod_heartmonitor denial of service CVE-2026-46729 Fix available 7.5 HighOctober 1, 2026
• apache http server Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories CVE-2026-42356 Fix available 3.7 LowOctober 1, 2026
• apache http server Apache HTTP Server: mod_dav shared lock overflow CVE-2026-42528 Fix available 4.3 MediumOctober 1, 2026
• apache http server Apache HTTP Server: mod_http2 memory corruption when file handles exhausted CVE-2026-48913 Fix available 7.3 HighJune 8, 2026
• apache http server, red hat jboss core services for rhel 8, enterprise linux 10 +10 more +12 more Apache HTTP Server: mod_xml2enc heap overflow CVE-2026-42536 Public exploitFix available 7.5 HighJune 8, 2026
• apache http server, red hat jboss core services for rhel 8, enterprise linux 10 +10 more +12 more Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` CVE-2026-44185 Fix available 7.3 HighJune 8, 2026
• apache http server, red hat jboss core services for rhel 8, enterprise linux 10 +10 more +12 more Apache HTTP Server: mod_proxy_html buffer overflow CVE-2026-34355 Fix available 7.5 HighJune 8, 2026
• apache http server Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow CVE-2026-44631 Fix available 9.8 CriticalJune 8, 2026
• apache http server Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules CVE-2026-44119 Fix available 5.5 MediumJune 8, 2026
• apache http server Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash CVE-2026-43951 Fix available 6.5 MediumJune 8, 2026
• apache http server Apache HTTP Server: mod_dav_fs protected directory access CVE-2026-42535 Fix available 9.1 CriticalJune 8, 2026
• apache http server Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow CVE-2026-34356 Fix available 7.5 HighJune 8, 2026
• apache http server Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp CVE-2026-44186 Fix available 7.3 HighJune 8, 2026
• apache http server Apache HTTP Server: mod_proxy_ftp XSS CVE-2026-29170 Fix available 6.1 MediumJune 8, 2026
• apache http server Apache HTTP Server: mod_ldap per-dir use-after-free CVE-2026-29167 Fix available 9.8 CriticalJune 8, 2026
• apache http server, debian linux, red hat jboss core services for rhel 8 +19 more +21 more Apache HTTP Server: mod_http2 denial of service CVE-2026-49975 Public exploitFix available EPSS 33.0% 7.5 HighJune 3, 2026
• apache http server Apache HTTP Server: mod_md unrestricted OCSP response CVE-2026-29168 Fix available 7.3 HighMay 5, 2026
• apache http server, red hat jboss core services for rhel 8, jboss core services on rhel 7 +15 more +17 more Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() CVE-2026-28780 Fix available 9.8 CriticalMay 5, 2026
• apache http server Apache HTTP Server: mod_dav_lock indirect lock crash CVE-2026-29169 Fix available 7.5 HighMay 4, 2026
• apache http server, red hat enterprise linux 10, enterprise linux 6 +5 more +7 more Apache HTTP Server: http2: double free and possible RCE on early reset CVE-2026-23918 Public exploitFix available EPSS 49.7% 8.8 HighMay 4, 2026
• apache http server Apache HTTP Server: mod_auth_digest timing attack CVE-2026-33006 Public exploitFix available 4.8 MediumMay 4, 2026
• apache http server Apache HTTP Server: mod_authn_socache crash CVE-2026-33007 Fix available 5.3 MediumMay 4, 2026
• apache http server Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line CVE-2026-33523 Fix available 6.5 MediumMay 4, 2026
• apache http server Apache HTTP Server: Off-by-one OOB reads in AJP getter functions CVE-2026-33857 Fix available 5.3 MediumMay 4, 2026
• apache http server Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) CVE-2026-34032 Fix available 5.3 MediumMay 4, 2026
• apache http server Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() CVE-2026-34059 Fix available 7.5 HighMay 4, 2026
• apache http server Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr CVE-2026-24072 Public exploitFix available 8.8 HighMay 4, 2026
• apache http server Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... CVE-2025-58098 Public exploitFix available 8.3 HighDecember 5, 2025
• apache http server Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo CVE-2025-66200 Fix available 5.4 MediumDecember 5, 2025
• apache http server Apache HTTP Server: CGI environment variable override CVE-2025-65082 Fix available 6.5 MediumDecember 5, 2025
• apache http server Apache HTTP Server: mod_md (ACME), unintended retry intervals CVE-2025-55753 Fix available 7.5 HighDecember 5, 2025
• apache http server Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF CVE-2025-59775 Fix available 7.5 HighDecember 5, 2025
• apache http server Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64 CVE-2025-54090 Fix available 6.3 MediumJuly 23, 2025
• Show olderLoading…