Where
-Infinity
0

Trending

Last week
Last month
Last year

Apache HTTP ServerAn insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs t…

Risk 80
Severity
9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

First published (updated )
CVE-2026-67402

Apache HTTP ServerApache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

Risk 55
Severity
7.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server

1 / 4
Source: Launchpad
First published (updated )
CVE-2026-44185

Apache HTTP ServerApache HTTP Server: mod_xml2enc heap overflow

Risk 46
Severity
7.5
Buffer Overflow
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with modxml2enc, xml2StartParse, and untrusted content

1 / 5
Source: Launchpad
First published (updated )
CVE-2026-42536

Apache HTTP ServerApache HTTP Server: mod_proxy_html buffer overflow

Risk 46
Severity
7.5
Buffer Overflow
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U

A buffer overflow in modproxyhtml in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

1 / 3
Source: Red Hat
First published (updated )
CVE-2026-34355

Apache HTTP ServerApache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Risk 91
Severity
9.8
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to modproxyajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

First published (updated )
CVE-2026-28780

Apache HTTP ServerApache HTTP Server: HTTP response splitting

Risk 47
Severity
7.5
Input Validation, XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2024-42516 - this is the "complete" fix for the CVE-2023-38709 response splitting issue. The patch issued upstream for CVE-2023-38709 did not fix the vulnerability.

1 / 6
Source: Red Hat
First published (updated )
CVE-2024-42516

Apache HTTP ServerApache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

Risk 46
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache HTTP Server: modproxyajp: Heap Over-Read and memory disclosure in ajpparsedata()

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-34059

Apache HTTP ServerApache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

Risk 29
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache HTTP Server: modproxyajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajpmsggetstring)

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-34032

Apache HTTP ServerApache HTTP Server: Off-by-one OOB reads in AJP getter functions

Risk 29
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-33857

Apache HTTP ServerApache HTTP Server: mod_dav_lock indirect lock crash

Risk 47
Severity
7.5
Null Pointer Dereference
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs.

The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove moddavlock.

1 / 2
Source: NVD
First published (updated )
CVE-2026-29169

Apache HTTP ServerApache HTTP Server: mod_authn_socache crash

Risk 29
Severity
5.3
Null Pointer Dereference
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

A NULL pointer dereference in the modauthnsocache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

1 / 2
Source: NVD
First published (updated )
CVE-2026-33007

Apache HTTP ServerNull Pointer Dereference

Risk 19
Severity
4
Null Pointer Dereference

A NULL pointer dereference in the modauthnsocache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

First published (updated )
REDHAT-BUG-2465299

Apache HTTP ServerImproper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affec…

Risk 19
Severity
4

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

First published (updated )
REDHAT-BUG-2464952

Apache HTTP ServerBuffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: throug…

Risk 19
Severity
4

Buffer Over-read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

First published (updated )
REDHAT-BUG-2464940

Apache HTTP ServerBuffer Overflow

Risk 33
Severity
7
Buffer Overflow

Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to modproxyajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

First published (updated )
REDHAT-BUG-2466913

Apache HTTP ServerOut-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apach…

Risk 19
Severity
4

Out-of-bounds Read vulnerability in modproxyajp of

Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

First published (updated )
REDHAT-BUG-2464953

Apache HTTP ServerApache HTTP Server: mod_ldap per-dir use-after-free

Risk 93
Severity
9.8
Trending
3 Months
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Last updated 8 July 2026

1 / 4
Source: Ubuntu
First published (updated )
CVE-2026-29167

Apache HTTP ServerApache HTTP Server: ProxyPassReverseCookieMap buffer overflow

Risk 46
Severity
7.5
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie

1 / 4
Source: Launchpad
First published (updated )
CVE-2026-34356

Apache HTTP ServerApache HTTP Server: OOB Read in `merge_response_headers` can cause crash

Risk 43
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Last updated 20 July 2026

1 / 4
Source: Ubuntu
First published (updated )
CVE-2026-43951

Apache HTTP ServerApache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

Risk 55
Severity
7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Last updated 20 July 2026

1 / 4
Source: Ubuntu
First published (updated )
CVE-2026-44186

Apache HTTP ServerApache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

Risk 92
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

1 / 4
Source: Launchpad
First published (updated )
CVE-2026-44631

Apache HTTP ServerNull Pointer Dereference

Risk 5
Severity
1
Null Pointer Dereference

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs.

The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove moddavlock.

First published (updated )
REDHAT-BUG-2465296

Apache HTTP ServerBuffer Overflow

Risk 33
Severity
7
Buffer Overflow

A buffer overflow in modproxyhtml in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

First published (updated )
REDHAT-BUG-2486414

Apache HTTP ServerBuffer Overflow

Risk 33
Severity
7
Buffer Overflow

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with modxml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

First published (updated )
REDHAT-BUG-2486411

Apache HTTP ServerBuffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker contr…

Risk 33
Severity
7

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

First published (updated )
REDHAT-BUG-2486397

Apache HTTP ServerBuffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configur…

Risk 19
Severity
4

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

First published (updated )
REDHAT-BUG-2486399

Apache HTTP ServerBuffer Overflow

Risk 19
Severity
4
Buffer Overflow

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

First published (updated )
REDHAT-BUG-2486395

Apache HTTP ServerOut-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple re…

Risk 19
Severity
4

Out-of-bounds Read vulnerability in Apache HTTP Server with modheaders and modmime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

First published (updated )
REDHAT-BUG-2486415

Apache HTTP ServerLoop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in …

Risk 33
Severity
7

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the modproxyftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

First published (updated )
REDHAT-BUG-2486402

Apache HTTP ServerUse After Free

Risk 5
Severity
1
Use After Free

Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

First published (updated )
REDHAT-BUG-2486394

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203