Skip to content

Product

Apache HTTP Server vulnerabilities

352 published CVES affecting Apache HTTP Server, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
352
Critical
31
High
131
Medium
175
Low
14
Unscored
1
CISA KEV
5

Latest Apache HTTP Server CVEs

Newest publication first · page 5 of 15

  1. CVE-2021-42013 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    Published
    CriticalCVSS 9.8 EPSS 100.0% CISA KEV added 2021-11-03 Ransomware Exploited in the wild Framework module Public exploit PoC

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by t...

  2. CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    Published
    CriticalCVSS 9.8 EPSS 100.0% CISA KEV added 2021-11-03 Ransomware Exploited in the wild Framework module Public exploit PoC

    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usu...

  3. CVE-2021-41524 null pointer dereference in h2 fuzzing

    Published
    HighCVSS 7.5 EPSS 25.8%

    While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known...

  4. CVE-2021-40438 mod_proxy SSRF

    Published
    CriticalCVSS 9.0 EPSS 100.0% CISA KEV added 2021-12-01 Ransomware Exploited in the wild

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

  5. CVE-2021-39275 ap_escape_quotes buffer overflow

    Published
    CriticalCVSS 9.8 EPSS 39.4%

    ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

  6. CVE-2021-36160 mod_proxy_uwsgi out of bound read

    Published
    HighCVSS 7.5 EPSS 63.7%

    A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

  9. CVE-2021-31618 NULL pointer dereference on specially crafted HTTP/2 request

    Published
    HighCVSS 7.5 EPSS 52.1%

    Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status...

  12. CVE-2021-26690 mod_session NULL pointer dereference

    Published
    HighCVSS 7.5 EPSS 65.1%

    Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

  13. CVE-2020-35452 mod_auth_digest possible stack overflow by one nul byte

    Published
    HighCVSS 7.3 EPSS 53.2%

    Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation...

  14. CVE-2020-13950 mod_proxy_http NULL pointer dereference

    Published
    HighCVSS 7.5 EPSS 50.0%

    Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

  16. CVE-2019-17567 mod_proxy_wstunnel tunneling of non Upgraded connections

    Published
    MediumCVSS 5.3 EPSS 59.7%

    Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP valid...

  17. CVE-2020-11985 IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for log...

    Published
    MediumCVSS 5.3 EPSS 7.1%

    IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but...

  18. CVE-2020-11993 Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing conc...

    Published
    HighCVSS 7.5 EPSS 56.6%

    Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" w...

  20. CVE-2020-9490 Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resour...

    Published
    HighCVSS 7.5 EPSS 88.8%

    Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate thi...

  24. CVE-2019-10097 In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buff...

    Published
    HighCVSS 7.2 EPSS 52.9%

    In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggere...

  25. CVE-2019-10092 In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead...

    Published
    MediumCVSS 6.1 EPSS 81.5%

    In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.