CVE security advisories and vulnerability history for httpd by apache.
Last updated
apache httpd has 113 published CVE records since 2016, of which 5 are in CISA's Known Exploited Vulnerabilities catalog and 20 have a known public exploit. The average CVSS base score across scored CVEs is 7.6.
This page aggregates every publicly disclosed vulnerability (CVE) affecting apache httpd, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.
How the CVSS severity of apache httpd's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.
75 additional CVEs have no CVSS severity score.
In CISA’s Known Exploited Vulnerabilities catalog
5
5 of apache httpd's CVEs are confirmed exploited in the wild.
Public exploits
20
20 of apache httpd's CVEs have a known public exploit available.
Browse every apache httpd version named in a CVE, then pick one to see only the CVEs that affect it.
113 CVEs
Added to CISA KEV 2025-05-01
Showing 30 of 113
The CWE weakness categories most often found in apache httpd CVEs. Follow any weakness for its full explanation.
How many apache httpd CVEs were published each year.
Browse vulnerabilities for other products by apache.
Common questions about apache httpd vulnerabilities.
apache httpd has 113 published CVE records since 2016.
Yes — 5 of apache httpd's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Yes — 20 of apache httpd's CVEs have a known public exploit.
77 distinct apache httpd versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
apache httpd's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-190 (Integer Overflow or Wraparound).
apache httpd has 8 critical and 22 high-severity CVEs.
The average CVSS base score across apache httpd's scored CVEs is 7.6.
Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.
Monitor new apache httpd vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.
