HS
Web Server
HTTP Server
On CISA KEVExploited in the wildRansomware-linked
351
CVEs
5
On KEV
9.8
Max CVSS
20
New 30D
Severity mix
Critical 33High 93Medium 43Low 1
Watch
Add HTTP Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33007 | 5.3 | May 4 | Apache HTTP Server: mod_authn_socache crash Affected: 2.4.0 through 2.4.66 |
| CVE-2026-33857 | 5.3 | May 4 | Apache HTTP Server: Off-by-one OOB reads in AJP getter functions Affected: through 2.4.66 |
| CVE-2026-34032 | 5.3 | May 4 | Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) Affected: through 2.4.66 |
| CVE-2024-40725 | 5.3 | Jul 18 | A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers Affected: 2.4.60; 2.4.61 |
| CVE-2022-37436 | 5.3 | Jan 17 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body Affected: before 2.4.55 |
| CVE-2022-28614 | 5.3 | Jun 9 | The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or… Affected: through 2.4.53 |
| CVE-2022-28330 | 5.3 | Jun 9 | Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module Affected: through 2.4.53 |
| CVE-2021-30641 | 5.3 | Jun 10 | Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' Affected: 2.4.39 through 2.4.46 |
| CVE-2019-17567 | 5.3 | Jun 10 | Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection… Affected: 2.4.6 through 2.4.46 |
| CVE-2020-11985 | 5.3 | Aug 7 | IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof… Affected: 2.4.1 through 2.4.23 |
| CVE-2020-1934 | 5.3 | Apr 1 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server Affected: 2.4.0 through 2.4.41 |
| CVE-2019-0196 | 5.3 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38 Affected: 2.4.17 through 2.4.38 |
| CVE-2019-0220 | 5.3 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38 Affected: 2.4.0 through 2.4.38 |
| CVE-2018-17189 | 5.3 | Jan 30 | In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server… Affected: 2.4.17 to 2.4.37 |
| CVE-2018-1283 | 5.3 | Mar 26 | In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their… Affected: 2.4.0 through 2.4.29 |
| CVE-2026-33006 | 4.8 | May 4 | Apache HTTP Server: mod_auth_digest timing attack Affected: through 2.4.66 |
| CVE-2026-42528 | 4.3 | Oct 1 | Apache HTTP Server: mod_dav shared lock overflow Affected: through 2.4.68 |
| CVE-2016-8612 | 4.3 | Mar 9 | Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a… Affected: before 2.4.23 |
| CVE-2019-0197 | 4.2 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38 Affected: 2.4.34 through 2.4.38 |
| CVE-2026-42356 | 3.7 | Oct 1 | Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories Affected: 2.4.60 through 2.4.68 |
| CVE-2015-3185 | – | Jul 20 | The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an… Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.6; +6 more |
| CVE-2015-3183 | – | Jul 20 | The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request… Affected: 2.2.0 before 2.2.31; 2.4.0 before 2.4.16 |
| CVE-2015-0253 | – | Jul 20 | The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a… Affected: 2.4.12 |
| CVE-2015-0228 | – | Mar 8 | The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process… Affected: through 2.4.12 |
| CVE-2014-8109 | – | Dec 29 | mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is… Affected: 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.6; 2.4.7; +2 more |
| CVE-2014-3583 | – | Dec 15 | The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer… Affected: 2.4.10 |
| CVE-2014-3581 | – | Oct 10 | The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of… Affected: 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.6; 2.4.7; +2 more |
| CVE-2014-3523 | – | Jul 20 | Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is… Affected: 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.6; 2.4.7; +2 more |
| CVE-2014-0231 | – | Jul 20 | The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a… Affected: 2.2.0 before 2.2.29; 2.4.0 before 2.4.10 |
| CVE-2014-0226 | – | Jul 20 | Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly… Affected: 2.2.0 before 2.2.29; 2.4.1 before 2.4.10 |
| CVE-2014-0118 | – | Jul 20 | The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote… Affected: 2.2.0 before 2.2.29; 2.4.1 before 2.4.10 |
| CVE-2014-0117 | – | Jul 20 | The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via… Affected: 2.4.6; 2.4.7; 2.4.8; 2.4.9 |
| CVE-2013-4352 | – | Jul 20 | The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP… Affected: 2.4.6 |
| CVE-2013-5704 | – | Apr 15 | The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent… Affected: 2.2.0; 2.2.2; 2.2.3; 2.2.4; 2.2.5; 2.2.6; +28 more |
| CVE-2014-0098 | – | Mar 18 | The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation… Affected: 2.2.0 before 2.2.27; 2.4.1 before 2.4.9 |
| CVE-2013-6438 | – | Mar 18 | The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections,… Affected: 2.2.0 before 2.2.27; 2.4.1 before 2.4.9 |
| CVE-2013-2249 | – | Jul 23 | mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the… Affected: 2.4.1 through 2.4.4 |
| CVE-2013-1896 | – | Jul 10 | mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service… Affected: 2.2.0 before 2.2.25; 2.4.1 before 2.4.6 |
| CVE-2013-1862 | – | Jun 10 | mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow… Affected: 2.0.0 before 2.0.65; 2.2.0 before 2.2.25 |
| CVE-2012-4558 | – | Feb 26 | Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the… Affected: 2.2; 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +21 more |
| CVE-2012-3499 | – | Feb 26 | Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script… Affected: 2.2; 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +21 more |
| CVE-2012-4557 | – | Nov 30 | The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows… Affected: 2.2.12; 2.2.13; 2.2.14; 2.2.15; 2.2.16; 2.2.17; +4 more |
| CVE-2012-3502 | – | Aug 22 | The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does… Affected: 2.4.0; 2.4.1; 2.4.2 |
| CVE-2012-2687 | – | Aug 22 | Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.6; +19 more |
| CVE-2012-0883 | – | Apr 18 | envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a… Affected: 2.2.0 before 2.2.23; 2.4.1 |
| CVE-2012-0053 | – | Jan 28 | protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows… Affected: 2.0.0 before 2.0.65; 2.2.0 before 2.2.22 |
| CVE-2012-0021 | – | Jan 28 | The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a… Affected: 2.2.17; 2.2.18; 2.2.19; 2.2.20; 2.2.21 |
| CVE-2012-0031 | – | Jan 18 | scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other… Affected: 2.0.0 before 2.0.65; 2.2.0 before 2.2.22 |
| CVE-2007-6750 | – | Dec 27 | The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the… Affected: through 2.2.14; 1.0; 1.0.2; 1.0.3; 1.0.5; 1.1; +34 more |
| CVE-2011-4317 | – | Nov 30 | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly… Affected: 1.3; 1.3.0; 1.3.1; 1.3.1.1; 1.3.2; 1.3.3; +34 more |