|
21
|
7.5
-
|
HIGH
Network
|
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory …
|
-
|
CVE-2024-27316
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.17
|
|
|
2.4.59
|
2024-11-21 18:04
2024-04-5
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
22
|
5.9
-
|
MEDIUM
Network
|
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection c…
|
CWE-404
Improper Resource Shutdown or Release
|
CVE-2023-45802
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.17
|
|
|
2.4.58
|
2024-11-21 17:27
2023-10-23
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
23
|
7.5
-
|
HIGH
Network
|
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resou…
|
-
|
CVE-2023-43622
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.55
|
|
|
2.4.58
|
2024-11-21 17:24
2023-10-23
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
24
|
7.5
-
|
HIGH
Network
|
Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
|
-
|
CVE-2023-31122
|
cpe:2.3:a:apache:http_server:*:*
|
|
2.4.57
|
|
|
2024-11-21 17:01
2023-10-23
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
25
|
9.8
-
|
CRITICAL
Network
|
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
Configurations are affected when mod_proxy is enabled along with some form…
|
-
|
CVE-2023-25690
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
2.4.55
|
|
|
2024-11-21 16:49
2023-03-8
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
26
|
7.5
-
|
HIGH
Network
|
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.
Special characters in the origin response header c…
|
-
|
CVE-2023-27522
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.30
|
2.4.55
|
|
|
2024-11-21 16:53
2023-03-8
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
27
|
5.3
-
|
MEDIUM
Network
|
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers…
|
-
|
CVE-2022-37436
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.55
|
2024-11-21 16:14
2023-01-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
28
|
9.0
-
|
CRITICAL
Network
|
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards reque…
|
-
|
CVE-2022-36760
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.55
|
2024-11-21 16:13
2023-01-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
29
|
7.5
-
|
HIGH
Network
|
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.
…
|
-
|
CVE-2006-20001
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.55
|
2024-11-21 09:10
2023-01-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
30
|
9.8
7.5
|
CRITICAL
Network
|
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based auth…
|
CWE-345
Insufficient Verification of Data Authenticity
|
CVE-2022-31813
|
cpe:2.3:a:apache:http_server:*:*
|
|
2.4.53
|
|
|
2024-11-21 16:05
2022-06-10
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|