debian/uwsgi vulnerabilities

Latest debian/uwsgi CVEs

Newest publication first

1. CVE-2024-24795 Apache HTTP Server: HTTP Response Splitting in multiple modules

   Published 2024-04-04

   Medium·CVSS 6.3 EPSS 2.9%

   HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

2. DLA-2768-2 uwsgi - regression update

   Published 2021-10-20

   Unknown

3. DLA-2768-1 uwsgi - security update

   Published 2021-09-29

   Unknown

4. CVE-2021-36160 mod_proxy_uwsgi out of bound read

   Published 2021-09-16

   High·CVSS 7.5 EPSS 63.7%

   A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

5. DLA-2362-1 uwsgi - security update

   Published 2020-09-03

   Unknown

6. CVE-2020-11984 Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

   Published 2020-08-07

   Critical·CVSS 9.8 EPSS 90.0%

   Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

7. DSA-4142-1 uwsgi - security update

   Published 2018-03-17

   Unknown

8. CVE-2018-7490 uWSGI Directory Traversal vulnerability

   Published 2018-02-26

   High·CVSS 7.5 EPSS 69.4% Public exploit

   uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.

9. DLA-1275-1 uwsgi - security update

   Published 2018-02-10

   Unknown

10. CVE-2018-6758 The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.

    Published 2018-02-06

    Critical·CVSS 9.8 EPSS 2.0%

    The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.