Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.
Last updated 20 July 2026
A NULL pointer dereference in the modauthnsocache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.
Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
802.1X. An authentication issue was addressed with improved state management.
Accounts. The issue was addressed with improved checks.
Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows
A flaw was found in Apache HTTP Server (httpd) versions 2.4.0 to 2.4.41. Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirected instead to an unexpected URL within the request URL.
A flaw was found in Apache's HTTP server (httpd) .The modproxyftp module may use uninitialized memory with proxying to a malicious FTP server. The highest threat from this vulnerability is to data confidentiality.
A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers.
A cross-site scripting vulnerability was found in Apache httpd, affecting the modproxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation.
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
Apache HTTP Server (httpd) through version 2.4.29 has a vulnerability in the handling of HTTP session headers in modsession. When modsession is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header.
Upstream Advisory:
https://httpd.apache.org/security/vulnerabilities24.html
Upstream Patch:
https://svn.apache.org/viewvc?view=revision&sortby=log&revision=1824477
Apache HTTP Server 2.4.16 release fixes the following issue:
) SECURITY: CVE-2015-3183 (cve.mitre.org) core: Fix chunk header parsing defect. Remove aprbrigadeflatten(), buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters. [Graham Leggett, Yann Ylavic]
External References:
http://www.apache.org/dist/httpd/CHANGES2.4.16
The following flaw has been fixed in the Apache HTTP Server:
"A flaw was found in modcgid. If a server using modcgid hosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang indefinitely, leading to denial of service."
External References:
http://httpd.apache.org/security/vulnerabilities24.html
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4558 tothe following vulnerability:
Name: CVE-2012-4558 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4558 Assigned: 20120821 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxybalancer.c?r1=1404653&r2=1413732&diffformat=h
Multiple cross-site scripting (XSS) vulnerabilities in the balancerhandler function in the manager interface in modproxybalancer.c in the modproxybalancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-3499 to the following vulnerability:
Name: CVE-2012-3499 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499 Assigned: 20120614 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modinfo.c?r1=1225799&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modstatus.c?r1=1389564&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/utilldapcachemgr.c?r1=1209766&r2=1418752&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/modimagemap.c?r1=1398480&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxyftp.c?r1=1404625&r2=1413732&diffformat=h
Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) modimagemap, (2) modinfo, (3) modldap, (4) modproxyftp, and (5) modstatus modules.
The proxy functionality in (1) modproxyajp.c in the modproxyajp module and (2) modproxyhttp.c in the modproxyhttp module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.