How many CVEs does Apache Software Foundation http server have?

Apache Software Foundation http server has 351 published CVE records since 1999.

How many Apache Software Foundation http server CVEs are in CISA KEV?

Yes — 5 of Apache Software Foundation http server's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for Apache Software Foundation http server vulnerabilities?

Yes — 94 of Apache Software Foundation http server's CVEs have a known public exploit.

Which versions of Apache Software Foundation http server are affected?

427 distinct Apache Software Foundation http server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation http server CVEs?

Apache Software Foundation http server's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-125 (Out-of-bounds Read), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-122 (Heap-based Buffer Overflow).

What is the average severity of Apache Software Foundation http server CVEs?

The average CVSS base score across Apache Software Foundation http server's scored CVEs is 6.3.

Apache Software Foundation http server Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every Apache Software Foundation http server version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

2.0.39 <= v <= 2.0.3929 CVEs
2.0.37 <= v <= 2.0.3728 CVEs
2.0.38 <= v <= 2.0.3828 CVEs
2.0.40 <= v <= 2.0.4028 CVEs
2.0.36 <= v <= 2.0.3627 CVEs
2.0.41 <= v <= 2.0.4127 CVEs
2.0.42 <= v <= 2.0.4227 CVEs
2.0.28 <= v <= 2.0.2826 CVEs
2.0.35 <= v <= 2.0.3526 CVEs
2.2.3 <= v <= 2.2.326 CVEs
2.0.43 <= v <= 2.0.4325 CVEs
2.0.44 <= v <= 2.0.4425 CVEs
2.0 <= v <= 2.024 CVEs
2.0.32 <= v <= 2.0.3224 CVEs
1.3.12 <= v <= 1.3.1223 CVEs
2.0.45 <= v <= 2.0.4523 CVEs
2.2.2 <= v <= 2.2.223 CVEs
2.2.4 <= v <= 2.2.422 CVEs
1.3.11 <= v <= 1.3.1121 CVEs
1.3.14 <= v <= 1.3.1421 CVEs
1.3.17 <= v <= 1.3.1721 CVEs
2.0.46 <= v <= 2.0.4621 CVEs
1.3.19 <= v <= 1.3.1920 CVEs
1.3.20 <= v <= 1.3.2020 CVEs
1.3.18 <= v <= 1.3.1819 CVEs
2.0.47 <= v <= 2.0.4719 CVEs
1.3.9 <= v <= 1.3.918 CVEs
2.0.48 <= v <= 2.0.4818 CVEs
2.2.6 <= v <= 2.2.618 CVEs
2.4.1 <= v <= 2.4.118 CVEs
1.3.22 <= v <= 1.3.2217 CVEs
2.2.0 <= v <= 2.2.017 CVEs
2.4.2 <= v <= 2.4.217 CVEs
1.3.23 <= v <= 1.3.2316 CVEs
1.3.26 <= v <= 1.3.2616 CVEs
1.3 <= v <= 1.315 CVEs
1.3.1 <= v <= 1.3.115 CVEs
1.3.24 <= v <= 1.3.2415 CVEs
1.3.25 <= v <= 1.3.2515 CVEs
2.0.49 <= v <= 2.0.4915 CVEs
2.2.1 <= v <= 2.2.115 CVEs
2.2.11 <= v <= 2.2.1115 CVEs
2.2.12 <= v <= 2.2.1215 CVEs
2.2.13 <= v <= 2.2.1315 CVEs
2.2.9 <= v <= 2.2.915 CVEs
1.3.27 <= v <= 1.3.2714 CVEs
1.3.3 <= v <= 1.3.314 CVEs
1.3.4 <= v <= 1.3.414 CVEs
1.3.6 <= v <= 1.3.614 CVEs
2.0.51 <= v <= 2.0.5114 CVEs
2.0.52 <= v <= 2.0.5214 CVEs
2.0.9 <= v <= 2.0.914 CVEs
2.2.14 <= v <= 2.2.1414 CVEs
2.2.8 <= v <= 2.2.814 CVEs
2.4.3 <= v <= 2.4.314 CVEs
2.4.6 <= v <= 2.4.614 CVEs
2.0.50 <= v <= 2.0.5013 CVEs
2.2.10 <= v <= 2.2.1013 CVEs
2.2.15 <= v <= 2.2.1513 CVEs
2.2.18 <= v <= 2.2.1813 CVEs
2.4.10 <= v <= 2.4.1013 CVEs
2.4.7 <= v <= 2.4.713 CVEs
2.4.9 <= v <= 2.4.913 CVEs
2.0.34 <= v <= 2.0.3412 CVEs
2.0.53 <= v <= 2.0.5312 CVEs
2.2.16 <= v <= 2.2.1612 CVEs
2.2.19 <= v <= 2.2.1912 CVEs
2.2.20 <= v <= 2.2.2012 CVEs
2.2.21 <= v <= 2.2.2112 CVEs
2.0.54 <= v <= 2.0.5411 CVEs
2.0.55 <= v <= 2.0.5511 CVEs
2.0.58 <= v <= 2.0.5811 CVEs
1.3.28 <= v <= 1.3.2810 CVEs
2.0.57 <= v <= 2.0.5710 CVEs
2.0.59 <= v <= 2.0.5910 CVEs
2.2 <= v <= 2.210 CVEs
2.4.12 <= v <= 2.4.1210 CVEs
2.4.20 <= v <= 2.4.2010 CVEs
2.4.4 <= v <= 2.4.410 CVEs
1.3.15 <= v <= 1.3.159 CVEs
1.3.29 <= v <= 1.3.299 CVEs
2.0.35 <= v < 2.0.649 CVEs
2.0.56 <= v <= 2.0.569 CVEs
2.2.17 <= v <= 2.2.179 CVEs
2.4.0 <= v <= 2.4.09 CVEs
2.4.18 <= v <= 2.4.189 CVEs
2.4.23 <= v <= 2.4.239 CVEs
1.0.3 <= v <= 1.0.38 CVEs
1.3.10 <= v <= 1.3.108 CVEs
1.3.13 <= v <= 1.3.138 CVEs
1.3.16 <= v <= 1.3.168 CVEs
1.3.7 <= v <= 1.3.78 CVEs
2.0.61 <= v <= 2.0.618 CVEs
2.4.0 <= v < 2.4.688 CVEs
2.4.16 <= v <= 2.4.168 CVEs
2.4.17 <= v <= 2.4.178 CVEs
< 2.4.677 CVEs
1.0 <= v <= 1.07 CVEs
1.0.5 <= v <= 1.0.57 CVEs
1.1 <= v <= 1.17 CVEs
1.3.0 <= v <= 1.3.07 CVEs
1.3.2 <= v <= 1.3.27 CVEs
1.3.31 <= v <= 1.3.317 CVEs
2.0.60 <= v <= 2.0.607 CVEs
2.4.0 <= v < 2.4.607 CVEs
2.4.25 <= v <= 2.4.257 CVEs
1.0.2 <= v <= 1.0.26 CVEs
1.1.1 <= v <= 1.1.16 CVEs
1.2.5 <= v <= 1.2.56 CVEs
2.0.63 <= v <= 2.0.636 CVEs
2.2.0 <= v < 2.2.126 CVEs
2.2.22 <= v <= 2.2.226 CVEs
2.2.23 <= v <= 2.2.236 CVEs
0.8.11 <= v <= 0.8.115 CVEs
0.8.14 <= v <= 0.8.145 CVEs
1.3.30 <= v <= 1.3.305 CVEs
1.3.32 <= v <= 1.3.325 CVEs
1.3.33 <= v <= 1.3.335 CVEs
1.3.34 <= v <= 1.3.345 CVEs
1.3.35 <= v <= 1.3.355 CVEs
1.3.36 <= v <= 1.3.365 CVEs
1.3.37 <= v <= 1.3.375 CVEs
1.3.38 <= v <= 1.3.385 CVEs
1.3.39 <= v <= 1.3.395 CVEs
1.3.5 <= v <= 1.3.55 CVEs
1.3.8 <= v <= 1.3.85 CVEs
2.1.1 <= v <= 2.1.15 CVEs
2.1.2 <= v <= 2.1.25 CVEs
2.1.3 <= v <= 2.1.35 CVEs
2.1.4 <= v <= 2.1.45 CVEs
2.1.5 <= v <= 2.1.55 CVEs
2.1.6 <= v <= 2.1.65 CVEs
2.2.0 <= v < 2.2.65 CVEs
2.4.26 <= v <= 2.4.265 CVEs
2.4.8 <= v <= 2.4.85 CVEs
1.2 <= v <= 1.24 CVEs
1.3.1.1 <= v <= 1.3.1.14 CVEs
1.3.41 <= v <= 1.3.414 CVEs
1.3.42 <= v <= 1.3.424 CVEs
1.3.65 <= v <= 1.3.654 CVEs
1.3.68 <= v <= 1.3.684 CVEs
2.0.0 <= v <= 2.4.484 CVEs
2.0.35 <= v < 2.0.514 CVEs
2.0.64 <= v <= 2.0.644 CVEs
2.1 <= v <= 2.14 CVEs
2.1.7 <= v <= 2.1.74 CVEs
2.1.8 <= v <= 2.1.84 CVEs
2.4.0 <= v < 2.4.644 CVEs
2.4.0 <= v <= 2.4.464 CVEs
2.4.19 <= v <= 2.4.194 CVEs
2.4.27 <= v <= 2.4.274 CVEs
2.4.33 <= v <= 2.4.334 CVEs
2.4.37 <= v <= 2.4.374 CVEs
< 2.4.543 CVEs
<= 2.4.293 CVEs
<= 2.4.523 CVEs
<= 2.4.533 CVEs
2.0.0 <= v < 2.0.613 CVEs
2.0.0 <= v < 2.0.653 CVEs
2.2.0 <= v < 2.2.143 CVEs
2.2.0 <= v < 2.2.173 CVEs
2.2.0 <= v < 2.2.293 CVEs
2.2.24 <= v <= 2.2.243 CVEs
2.2.25 <= v <= 2.2.253 CVEs
2.2.26 <= v <= 2.2.263 CVEs
2.2.27 <= v <= 2.2.273 CVEs
2.4.1 <= v <= 2.4.233 CVEs
2.4.14 <= v <= 2.4.143 CVEs
2.4.21 <= v <= 2.4.213 CVEs
2.4.22 <= v <= 2.4.223 CVEs
2.4.28 <= v <= 2.4.283 CVEs
2.4.29 <= v <= 2.4.293 CVEs
2.4.49 <= v <= 2.4.493 CVEs
< 2.4.552 CVEs
< 2.4.682 CVEs
<= 2.2.142 CVEs
<= 2.4.482 CVEs
1.2.4 <= v <= 1.2.42 CVEs
1.2.6 <= v <= 1.2.62 CVEs
1.3.0 <= v < 1.3.312 CVEs
2.0.0 <= v < 2.0.492 CVEs
2.0.35 <= v < 2.0.552 CVEs
2.0.35 <= v <= 2.0.612 CVEs
2.2.0 <= v < 2.2.152 CVEs
2.2.0 <= v < 2.2.222 CVEs
2.2.0 <= v < 2.2.232 CVEs
2.2.0 <= v < 2.2.252 CVEs
2.2.0 <= v < 2.2.272 CVEs
2.2.0 <= v < 2.2.332 CVEs
2.2.0 <= v <= 2.2.312 CVEs
2.2.0 <= v <= 2.2.62 CVEs
2.2.29 <= v <= 2.2.292 CVEs
2.2.31 <= v <= 2.2.312 CVEs
2.2.32 <= v <= 2.2.322 CVEs
2.2.5 <= v <= 2.2.52 CVEs
2.4.0 <= v < 2.4.262 CVEs
2.4.0 <= v < 2.4.662 CVEs
2.4.0 <= v < 2.4.672 CVEs
2.4.0 <= v <= 2.4.292 CVEs
2.4.0 <= v <= 2.4.382 CVEs
2.4.0 <= v <= 2.4.392 CVEs
2.4.0 <= v <= 2.4.412 CVEs
2.4.0 <= v <= 2.4.592 CVEs
2.4.1 <= v < 2.4.102 CVEs
2.4.1 <= v < 2.4.92 CVEs
2.4.17 <= v <= 2.4.382 CVEs
2.4.24 <= v <= 2.4.242 CVEs
2.4.34 <= v <= 2.4.342 CVEs
2.4.35 <= v <= 2.4.352 CVEs
2.4.38 <= v <= 2.4.382 CVEs
2.4.60 <= v <= 2.4.602 CVEs
< 1.01 CVE
< 1.3.01 CVE
< 1.3.241 CVE
< 1.3.351 CVE
< 2.4.231 CVE
< 2.4.491 CVE
< 2.4.521 CVE
< 2.4.581 CVE
< 2.4.591 CVE
< 2.4.621 CVE
< 2.4.641 CVE
< 2.4.661 CVE
<= 1.2.51 CVE
<= 1.3.11 CVE
<= 1.3.271 CVE
<= 1.3.301 CVE
<= 1.3.411 CVE
<= 2.0.471 CVE
<= 2.0.491 CVE
<= 2.0.521 CVE
<= 2.0.631 CVE
<= 2.2.331 CVE
<= 2.2.341 CVE
<= 2.4.121 CVE
<= 2.4.581 CVE
<= 2.4.591 CVE
1.15.17 <= v <= 1.15.171 CVE
1.2.2 <= v <= 1.3.241 CVE
1.2.9 <= v <= 1.2.91 CVE
1.3 <= v <= 1.3.321 CVE
1.3.0 <= v < 1.3.261 CVE
1.3.0 <= v < 1.3.271 CVE
1.3.0 <= v < 1.3.391 CVE
1.3.0 <= v <= 1.3.391 CVE
1.3.11 <= v <= 1.3.201 CVE
1.3.2 <= v < 1.3.391 CVE
1.3.2 <= v <= 1.3.391 CVE
1.3.28 <= v < 1.3.371 CVE
1.3.3 <= v < 1.3.351 CVE
1.3.40 <= v <= 1.3.401 CVE
1.4.0 <= v <= 1.4.01 CVE
1.99 <= v <= 1.991 CVE
2.0 <= v < 2.0.561 CVE
2.0.0 <= v < 2.0.341 CVE
2.0.0 <= v < 2.0.461 CVE
2.0.0 <= v <= 2.0.361 CVE
2.0.0 <= v <= 2.0.441 CVE
2.0.0 <= v <= 2.0.651 CVE
2.0.11 <= v <= 2.0.111 CVE
2.0.12 <= v <= 2.0.121 CVE
2.0.13 <= v <= 2.0.131 CVE
2.0.14 <= v <= 2.0.141 CVE
2.0.15 <= v <= 2.0.151 CVE
2.0.16 <= v <= 2.0.161 CVE
2.0.17 <= v <= 2.0.171 CVE
2.0.18 <= v <= 2.0.181 CVE
2.0.19 <= v <= 2.0.191 CVE
2.0.20 <= v <= 2.0.201 CVE
2.0.21 <= v <= 2.0.211 CVE
2.0.22 <= v <= 2.0.221 CVE
2.0.23 <= v <= 2.0.231 CVE
2.0.24 <= v <= 2.0.241 CVE
2.0.25 <= v <= 2.0.251 CVE
2.0.26 <= v <= 2.0.261 CVE
2.0.27 <= v <= 2.0.271 CVE
2.0.29 <= v <= 2.0.291 CVE
2.0.30 <= v <= 2.0.301 CVE
2.0.31 <= v <= 2.0.311 CVE
2.0.33 <= v <= 2.0.331 CVE
2.0.35 <= v < 2.0.481 CVE
2.0.35 <= v < 2.0.501 CVE
2.0.35 <= v < 2.0.611 CVE
2.0.35 <= v < 2.0.631 CVE
2.0.35 <= v < 2.0.651 CVE
2.0.35 <= v <= 2.0.541 CVE
2.0.36 <= v < 2.0.551 CVE
2.0.37 <= v < 2.0.611 CVE
2.0.37 <= v < 2.0.641 CVE
2.0.44 <= v < 2.0.511 CVE
2.0.46 <= v < 2.0.591 CVE
2.1.9 <= v <= 2.1.91 CVE
2.2.0 <= v < 2.2.161 CVE
2.2.0 <= v < 2.2.201 CVE
2.2.0 <= v < 2.2.31 CVE
2.2.0 <= v < 2.2.311 CVE
2.2.0 <= v < 2.2.81 CVE
2.2.0 <= v < 2.2.91 CVE
2.2.0 <= v <= 2.2.181 CVE
2.2.0 <= v <= 2.2.91 CVE
2.2.12 <= v <= 2.2.201 CVE
2.2.15-60 <= v <= 2.2.15-601 CVE
2.2.30 <= v <= 2.2.301 CVE
2.2.7 <= v <= 2.2.71 CVE
2.3.0 <= v < 2.3.71 CVE
2.3.0 <= v <= 2.3.01 CVE
2.3.4 <= v <= 2.3.41 CVE
2.3.5 <= v <= 2.3.51 CVE
2.3.6 <= v <= 2.3.61 CVE
2.4.0 <= v < 2.4.101 CVE
2.4.0 <= v < 2.4.161 CVE
2.4.0 <= v < 2.4.531 CVE
2.4.0 <= v < 2.4.541 CVE
2.4.0 <= v < 2.4.551 CVE
2.4.0 <= v < 2.4.591 CVE
2.4.0 <= v <= 2.4.261 CVE
2.4.0 <= v <= 2.4.371 CVE
2.4.0 <= v <= 2.4.551 CVE
2.4.0 <= v <= 2.4.671 CVE
2.4.1 <= v < 2.4.31 CVE
2.4.1 <= v < 2.4.61 CVE
2.4.1 <= v <= 2.4.41 CVE
2.4.13 <= v <= 2.4.131 CVE
2.4.17 <= v < 2.4.491 CVE
2.4.17 <= v < 2.4.581 CVE
2.4.17 <= v < 2.4.591 CVE
2.4.17 <= v < 2.4.641 CVE
2.4.17 <= v < 2.4.681 CVE
2.4.17 <= v <= 2.4.341 CVE
2.4.17 <= v <= 2.4.581 CVE
2.4.18 <= v <= 2.4.301 CVE
2.4.18 <= v <= 2.4.391 CVE
2.4.20 <= v < 2.4.401 CVE
2.4.20 <= v < 2.4.441 CVE
2.4.20 <= v < 2.4.461 CVE
2.4.20 <= v <= 2.4.391 CVE
2.4.26 <= v < 2.4.641 CVE
2.4.30 <= v < 2.4.491 CVE
2.4.30 <= v < 2.4.561 CVE
2.4.30 <= v < 2.4.661 CVE
2.4.30 <= v < 2.4.671 CVE
2.4.30 <= v <= 2.4.301 CVE
2.4.30 <= v <= 2.4.551 CVE
2.4.32 <= v <= 2.4.431 CVE
2.4.34 <= v <= 2.4.381 CVE
2.4.35 <= v < 2.4.641 CVE
2.4.39 <= v <= 2.4.461 CVE
2.4.41 <= v <= 2.4.461 CVE
2.4.47 <= v <= 2.4.471 CVE
2.4.50 <= v <= 2.4.501 CVE
2.4.53 <= v <= 2.4.531 CVE
2.4.55 <= v < 2.4.581 CVE
2.4.55 <= v < 2.4.681 CVE
2.4.55 <= v <= 2.4.591 CVE
2.4.6 <= v <= 2.4.461 CVE
2.4.61 <= v <= 2.4.611 CVE
2.4.64 <= v <= 2.4.641 CVE
2.4.66 <= v <= 2.4.661 CVE
2.4.7 <= v < 2.4.521 CVE
2.4.7 <= v < 2.4.661 CVE

Fixed in

2.4.6812 CVEs
2.0.6410 CVEs
2.4.6710 CVEs
2.4.648 CVEs
2.4.607 CVEs
2.2.126 CVEs
2.0.515 CVEs
2.0.615 CVEs
2.2.65 CVEs
2.4.665 CVEs
2.0.654 CVEs
2.4.544 CVEs
> 2.4.593 CVEs
2.0.553 CVEs

Find a version

351 CVEs

Sort

Apache HTTP Server: mod_http2 denial of service
CVE-2026-49975
Public exploit
Patch
Workaround
CWE-789
High · CVSS 7.5
EPSS 28.0% (98th pct)2026-06-08
Apache HTTP Server: mod_http2 memory corruption when file handles exhausted
CVE-2026-48913
Patch
CWE-416
High · CVSS 7.3
EPSS 0.5% (39th pct)2026-06-08
Apache HTTP Server: mod_xml2enc heap overflow
CVE-2026-42536
Patch
Workaround
CWE-122
High · CVSS 7.5
EPSS 1.0% (58th pct)2026-06-08
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
CVE-2026-44185
Patch
Workaround
CWE-126
High · CVSS 7.3
EPSS 0.7% (49th pct)2026-06-08
Apache HTTP Server: mod_proxy_html buffer overflow
CVE-2026-34355
Patch
Workaround
CWE-122
High · CVSS 7.5
EPSS 1.1% (62th pct)2026-06-08
Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
CVE-2026-44631
Patch
CWE-124
Critical · CVSS 9.8
EPSS 0.5% (40th pct)2026-06-08
Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules
CVE-2026-44119
Patch
CWE-269
Medium · CVSS 5.5
EPSS 0.2% (8th pct)2026-06-08
Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
CVE-2026-43951
Patch
CWE-125
Medium · CVSS 6.5
EPSS 0.5% (43th pct)2026-06-08
Apache HTTP Server: mod_dav_fs protected directory access
CVE-2026-42535
Patch
CWE-668
Critical · CVSS 9.1
EPSS 0.5% (42th pct)2026-06-08
Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
CVE-2026-34356
Patch
CWE-122
High · CVSS 7.5
EPSS 0.7% (50th pct)2026-06-08
Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
CVE-2026-44186
Patch
CWE-835
High · CVSS 7.3
EPSS 0.6% (44th pct)2026-06-08
Apache HTTP Server: mod_proxy_ftp XSS
CVE-2026-29170
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.5% (41th pct)2026-06-08
Apache HTTP Server: mod_ldap per-dir use-after-free
CVE-2026-29167
Patch
CWE-416
Critical · CVSS 9.8
EPSS 0.7% (49th pct)2026-06-08
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
CVE-2026-28780
Patch
CWE-122
Critical · CVSS 9.8
EPSS 1.4% (69th pct)2026-05-05
Apache HTTP Server: mod_md unrestricted OCSP response
CVE-2026-29168
Patch
CWE-770
High · CVSS 7.3
EPSS 0.6% (46th pct)2026-05-05
Apache HTTP Server: mod_dav_lock indirect lock crash
CVE-2026-29169
Patch
CWE-476
High · CVSS 7.5
EPSS 0.6% (45th pct)2026-05-04
Apache HTTP Server: http2: double free and possible RCE on early reset
CVE-2026-23918
Public exploit
Patch
Workaround
CWE-415
High · CVSS 8.8
EPSS 49.7% (99th pct)2026-05-04
Apache HTTP Server: mod_auth_digest timing attack
CVE-2026-33006
Public exploit
Patch
CWE-208
Medium · CVSS 4.8
EPSS 0.6% (43th pct)2026-05-04
Apache HTTP Server: mod_authn_socache crash
CVE-2026-33007
Patch
CWE-476
Medium · CVSS 5.3
EPSS 0.5% (41th pct)2026-05-04
Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
CVE-2026-33523
Patch
CWE-443
Medium · CVSS 6.5
EPSS 0.4% (36th pct)2026-05-04
Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
CVE-2026-33857
Patch
CWE-125
Medium · CVSS 5.3
EPSS 0.4% (32th pct)2026-05-04
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
CVE-2026-34032
Patch
CWE-125
Medium · CVSS 5.3
EPSS 0.5% (39th pct)2026-05-04
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
CVE-2026-34059
Patch
CWE-126
High · CVSS 7.5
EPSS 0.4% (32th pct)2026-05-04
Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
CVE-2026-24072
Patch
CWE-269
High · CVSS 8.8
EPSS 0.7% (48th pct)2026-05-04
Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
CVE-2025-58098
Patch
CWE-201
High · CVSS 8.3
EPSS 1.5% (72th pct)2025-12-05
Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo
CVE-2025-66200
Patch
CWE-288
Medium · CVSS 5.4
EPSS 0.6% (45th pct)2025-12-05
Apache HTTP Server: CGI environment variable override
CVE-2025-65082
Patch
CWE-150
Medium · CVSS 6.5
EPSS 0.8% (52th pct)2025-12-05
Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF
CVE-2025-59775
Patch
CWE-918
High · CVSS 7.5
EPSS 0.8% (52th pct)2025-12-05
Apache HTTP Server: mod_md (ACME), unintended retry intervals
CVE-2025-55753
Patch
CWE-190
High · CVSS 7.5
EPSS 0.4% (34th pct)2025-12-05
Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
CVE-2025-54090
Patch
CWE-253
Medium · CVSS 6.3
EPSS 0.7% (49th pct)2025-07-23

Showing 30 of 351

Apache Software Foundation http server Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other Apache Software Foundation products

Frequently asked questions

References

Track Apache Software Foundation http server vulnerabilities