Apache HTTP Server: moduserdir information disclosure

Apache HTTP Server: modauthdigest DoS attack

Apache HTTP Server: modauthdigest one-time-nonce replay attack

Apache HTTP Server: modvhostalias stack overflow

Apache HTTP Server: modproxyftp PASV address handling

Apache HTTP Server: modproxyhtml: crash in dumpcontent

Apache HTTP Server: modssl SSLRequire allows .htaccess apexpr file-function

Apache HTTP Server: modcharsetlite: Heap overflow in finishpartialchar

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.

Apache HTTP Server: moddavfs property database read access

Apache HTTP Server: modhttp2 use-after-free / wild write via shared session->bbtmp re-entrancy

Apache HTTP Server: modrewrite use-after-free via %{LA-U:HTTP:...}

Apache HTTP Server: modheartmonitor denial of service

Apache HTTP Server: modauthdigest reauthentication attack

A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.

Users are recommended to upgrade to version 2.4.69, which fixes this issue

Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Last updated 8 July 2026

A buffer overflow in modproxyhtml in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with modxml2enc, xml2StartParse, and untrusted content

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie

Last updated 20 July 2026

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server

Last updated 20 July 2026

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

Apache HTTP Server: Out-of-Bounds Write in apdirectorywalk() Canonical-Name Rewrite on CASEBLINDFILESYSTEM

A NULL pointer dereference in the modauthnsocache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

An HTTP request smuggling vulnerability was found in the modproxyajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests.