Apache HTTP Server vulnerabilities

Latest Apache HTTP Server CVEs

Newest publication first · page 2 of 23

1. CVE-2026-93302 Trusted peer certificate match ignores public key, allowing forged CA clones

   Published 2026-09-27

   High·CVSS 8.3 EPSS 0.24%

   MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the c...

2. CVE-2026-89281 CVE-2026-89281

   Published 2026-09-22

   High·CVSS 8.4 EPSS 0.18%

   The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.

3. CVE-2026-89282 CVE-2026-89282

   Published 2026-09-22

   Critical·CVSS 9.1 EPSS 0.48%

   The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users.

4. CVE-2026-49975 Apache HTTP Server: mod_http2 denial of service

   Published 2026-06-08

   High·CVSS 7.5 EPSS 33.0%

   Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

5. CVE-2026-48913 Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

   Published 2026-06-08

   High·CVSS 7.3 EPSS 0.48%

   Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

6. CVE-2026-42536 Apache HTTP Server: mod_xml2enc heap overflow

   Published 2026-06-08

   High·CVSS 7.5 EPSS 1.0%

   Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

7. CVE-2026-44185 Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

   Published 2026-06-08

   High·CVSS 7.3 EPSS 0.74%

   Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

8. CVE-2026-34355 Apache HTTP Server: mod_proxy_html buffer overflow

   Published 2026-06-08

   High·CVSS 7.5 EPSS 1.2%

   A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

9. CVE-2026-44631 Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

   Published 2026-06-08

   Critical·CVSS 9.8 EPSS 0.50%

   Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

10. CVE-2026-44119 Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules

    Published 2026-06-08

    Medium·CVSS 5.5 EPSS 0.18%

    Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgrade to version 2.4.68,...

11. CVE-2026-43951 Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

    Published 2026-06-08

    Medium·CVSS 6.5 EPSS 0.55%

    Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

12. CVE-2026-42535 Apache HTTP Server: mod_dav_fs protected directory access

    Published 2026-06-08

    Critical·CVSS 9.1 EPSS 0.54%

    A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

13. CVE-2026-34356 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow

    Published 2026-06-08

    High·CVSS 7.5 EPSS 0.71%

    Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

14. CVE-2026-44186 Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

    Published 2026-06-08

    High·CVSS 7.3 EPSS 0.58%

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, whic...

15. CVE-2026-29170 Apache HTTP Server: mod_proxy_ftp XSS

    Published 2026-06-08

    Medium·CVSS 6.1 EPSS 0.48%

    A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to upgrade to version 2.4.68, which...

16. CVE-2026-29167 Apache HTTP Server: mod_ldap per-dir use-after-free

    Published 2026-06-08

    Critical·CVSS 9.8 EPSS 0.69%

    Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

17. CVE-2026-28780 Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

    Published 2026-05-05

    High·CVSS 8.1 EPSS 1.4%

    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap ba...

18. CVE-2026-29168 Apache HTTP Server: mod_md unrestricted OCSP response

    Published 2026-05-05

    High·CVSS 7.3 EPSS 0.63%

    Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

19. CVE-2026-29169 Apache HTTP Server: mod_dav_lock indirect lock crash

    Published 2026-05-04

    High·CVSS 7.5 EPSS 0.59%

    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apach...

20. CVE-2026-23918 Apache HTTP Server: http2: double free and possible RCE on early reset

    Published 2026-05-04

    High·CVSS 8.8 EPSS 49.7%

    Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

21. CVE-2026-33006 Apache HTTP Server: mod_auth_digest timing attack

    Published 2026-05-04

    Medium·CVSS 4.8 EPSS 0.56%

    A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

22. CVE-2026-33007 Apache HTTP Server: mod_authn_socache crash

    Published 2026-05-04

    Medium·CVSS 5.3 EPSS 0.51%

    A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

23. CVE-2026-33523 Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

    Published 2026-05-04

    Medium·CVSS 6.5 EPSS 0.44%

    HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

24. CVE-2026-33857 Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

    Published 2026-05-04

    Medium·CVSS 5.3 EPSS 0.39%

    Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

25. CVE-2026-34032 Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

    Published 2026-05-04

    Medium·CVSS 5.3 EPSS 0.49%

    Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.