What’s Vulnerable › Products
Apache HTTP Server vulnerabilities
350 known vulnerabilities, 5 confirmed exploited in the wild (CISA KEV), 59 published in the last 12 months.
Check whether your Apache HTTP Server version is affected
Exploited Apache HTTP Server vulnerabilities
- CVE-2024-38475 — Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2021-40438 — Apache HTTP Server-Side Request Forgery (SSRF)
- CVE-2021-42013 — Apache HTTP Server Path Traversal Vulnerability
- CVE-2021-41773 — Apache HTTP Server Path Traversal Vulnerability
- CVE-2019-0211 — Apache HTTP Server Privilege Escalation Vulnerability
Latest Apache HTTP Server vulnerabilities
- CVE-2026-93546 — Apache HTTP Server: mod_dav_fs namespace overflow (CVSS 8.8)
- CVE-2026-79768 — Apache HTTP Server: mod_userdir information disclosure (CVSS 5.3)
- CVE-2026-73637 — Apache HTTP Server: mod_auth_digest DoS attack (CVSS 7.3)
- CVE-2026-73636 — Apache HTTP Server: mod_auth_digest one-time-nonce replay attack (CVSS 8.1)
- CVE-2026-63718 — Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling (CVSS 7.5)
- CVE-2026-63686 — Apache HTTP Server: mod_xml2enc crash on charset conversion failure (CVSS 7.5)
- CVE-2026-63292 — Apache HTTP Server: mod_vhost_alias stack overflow (CVSS 7.5)
- CVE-2026-63045 — Apache HTTP Server: mod_proxy_ftp PASV address handling (CVSS 7.5)
- CVE-2026-59797 — Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function (CVSS 9.8)
- CVE-2026-59685 — Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM (CVSS 7.5)
- CVE-2026-58415 — Apache HTTP Server: mod_dav_fs property database read access (CVSS 5.3)
- CVE-2026-57941 — Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVSS 9.8)
- CVE-2026-56449 — Apache HTTP Server: mod_proxy_html: crash in dump_content (CVSS 7.5)
- CVE-2026-56154 — Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} (CVSS 9.8)
- CVE-2026-56153 — Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char (CVSS 7.5)
- CVE-2026-48005 — Apache HTTP Server: mod_auth_digest reauthentication attack (CVSS 7.5)
- CVE-2026-47360 — Apache HTTP Server: mod_session: Session cookie not removed during internal redirect (CVSS 7.5)
- CVE-2026-46729 — Apache HTTP Server: mod_heartmonitor denial of service (CVSS 7.5)
- CVE-2026-42528 — Apache HTTP Server: mod_dav shared lock overflow (CVSS 4.3)
- CVE-2026-42356 — Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories (CVSS 3.7)
- CVE-2026-49975 — Apache HTTP Server: mod_http2 denial of service (CVSS 7.5)
- CVE-2026-48913 — Apache HTTP Server: mod_http2 memory corruption when file handles exhausted (CVSS 7.3)
- CVE-2026-44631 — Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow (CVSS 9.8)
- CVE-2026-44186 — Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp (CVSS 7.3)
- CVE-2026-44185 — Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (CVSS 7.3)