|
11
|
7.5
-
|
HIGH
Network
|
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.
Users are recommended to upgrade to version 2.4.68, which fixes this issue.
|
CWE-122
Heap-based Buffer Overflow
|
CVE-2026-34355
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.68
|
2026-06-10 01:20
2026-06-9
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
12
|
6.1
-
|
MEDIUM
Network
|
A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or revers…
|
CWE-79
Cross-site Scripting
|
CVE-2026-29170
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.68
|
2026-06-10 01:21
2026-06-9
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
13
|
9.8
-
|
CRITICAL
Network
|
Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to…
|
CWE-416
Use After Free
|
CVE-2026-29167
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.68
|
2026-06-10 01:29
2026-06-9
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
14
|
7.3
-
|
HIGH
Network
|
Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data.
This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.
Users a…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-29168
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.30
|
|
|
2.4.67
|
2026-05-7 03:39
2026-05-5
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
15
|
7.5
-
|
HIGH
Network
|
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav o…
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-29169
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.67
|
2026-05-5 11:36
2026-05-5
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
16
|
7.5
-
|
HIGH
Network
|
SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.
Users are recommended to…
|
-
|
CVE-2024-40898
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.62
|
2024-11-21 18:31
2024-07-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
17
|
5.3
-
|
MEDIUM
Network
|
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some…
|
NVD-CWE-noinfo
|
CVE-2024-40725
|
cpe:2.3:a:apache:http_server:2.4.61:*
cpe:2.3:a:apache:http_server:2.4.60:*
|
|
|
|
|
2024-11-21 18:31
2024-07-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
18
|
7.5
-
|
HIGH
Network
|
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.
Users are recommended to upgrade to version 2.4.60, whic…
|
-
|
CVE-2024-38477
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.60
|
2024-11-21 18:26
2024-07-2
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
19
|
9.8
-
|
CRITICAL
Network
|
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious o…
|
NVD-CWE-noinfo
|
CVE-2024-38476
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
2.4.60
|
|
|
2024-11-21 18:26
2024-07-2
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
20
|
9.8
-
|
CRITICAL
Network
|
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in
directories permitted by the configuration but not directly reachable by any …
|
-
|
CVE-2024-38474
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.60
|
2024-11-21 18:26
2024-07-2
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|