Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to modproxyajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
Last updated 8 July 2026
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.
A path handling issue in moddavfs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.
A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix page frag corruption on page fault
Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file.
The root cause is quite similar to the one addressed by commit 20eb4f29b602 ("net: fix skpagefrag() recursion from memory reclaim"). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file.
The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk->skallaction for such socket does not prevent the usage for the taskfrag, the nested allocation modify "under the hood" the page frag in use by the outer sendmsg call, corrupting the stream.
The overall relevant stack trace looks like the following:
httpd 78268 [001] 3461630.850950: probe:tcpsendmsglocked: ffffffff91461d91 tcpsendmsglocked+0x1 ffffffff91462b57 tcpsendmsg+0x27 ffffffff9139814e socksendmsg+0x3e ffffffffc06dfe1d smbsendkvec+0x28 [...] ffffffffc06cfaf8 cifsreadpages+0x213 ffffffff90e83c4b readpages+0x6b ffffffff90e83f31 dopagecachereadahead+0x1c1 ffffffff90e79e98 filemapfault+0x788 ffffffff90eb0458 dofault+0x38 ffffffff90eb5280 dofault+0x1a0 ffffffff90eb7c84 handlemmfault+0x4d4 ffffffff90eb8093 handlemmfault+0xc3 ffffffff90c74f6d dopagefault+0x1ed ffffffff90c75277 dopagefault+0x37 ffffffff9160111e pagefault+0x1e ffffffff9109e7b5 copyin+0x25 ffffffff9109eb40 copyfromiterfull+0xe0 ffffffff91462370 tcpsendmsglocked+0x5e0 ffffffff91462370 tcpsendmsglocked+0x5e0 ffffffff91462b57 tcpsendmsg+0x27 ffffffff9139815c socksendmsg+0x4c ffffffff913981f7 sockwriteiter+0x97 ffffffff90f2cc56 doiterreadvwritev+0x156 ffffffff90f2dff0 doiterwrite+0x80 ffffffff90f2e1c3 vfswritev+0xa3 ffffffff90f2e27c dowritev+0x5c ffffffff90c042bb dosyscall64+0x5b ffffffff916000ad entrySYSCALL64afterhwframe+0x65
The cifs filesystem rightfully sets skallocations to GFPNOFS, we can avoid the nesting using the sk page frag for allocation lacking the GFPFS flag. Do not define an additional mm-helper for that, as this is strictly tied to the sk page frag usage.
v1 -> v2: - use a stricted skpagefrag() check instead of reordering the code (Eric)
An out-of-bounds read/write vulnerability was found in the modsed module of httpd. This flaw allows an attacker to overwrite the memory of an httpd instance that is using modsed with data provided by the attacker.
A flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling.
A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write.
A vulnerability was found in httpd. This security issue occurs when some modproxy configurations on Apache HTTP Server allow an HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution.
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
Apache HTTP Server contains an improper escaping of output vulnerability in modrewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
An out-of-bounds write in function apescapequotes of httpd allows an unauthenticated remote attacker to crash the server or potentially execute code on the system with the privileges of the httpd user, by providing malicious input to the function.
A flaw was found in Apache httpd in versions 2.4.32 to 2.4.46. The uwsgi protocol does not serialize more than 16K of HTTP header leading to resource exhaustion and denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
Last updated 18 December 2024
modcgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.
modproxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.
Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
phf CGI program allows remote command execution through shell metacharacters.
Marsh Ray of PhoneFactor has discovered a flaw in the TLS/SSL protocol related to the handling of the session rehandshakes / renegotiations. This flaw can possibly be used in the MITM attacks and allowing an attacker to inject attacker-chosen plain text prefix to the session of the victim.
Further details are available in the "Authentication Gap in TLS Renegotiation" blog post: http://extendedsubset.com/?p=8
A buffer overflow flaw in httpd's lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability.
A heap overflow flaw was found In Apache httpd modsession. The highest threat from this vulnerability is to system availability.
A read-after-free vulnerability was discovered in Apache httpd, in modhttp2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash.
apache. Multiple issues were addressed by updating to version 2.4.27.