|
1
|
7.3
-
|
HIGH
Network
|
Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data.
This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.
Users a…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-29168
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.30
|
|
|
2.4.67
|
2026-05-7 03:39
2026-05-5
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2
|
7.5
-
|
HIGH
Network
|
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav o…
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-29169
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.67
|
2026-05-5 11:36
2026-05-5
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3
|
7.5
-
|
HIGH
Network
|
SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.
Users are recommended to…
|
-
|
CVE-2024-40898
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.62
|
2024-11-21 18:31
2024-07-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4
|
5.3
-
|
MEDIUM
Network
|
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some…
|
NVD-CWE-noinfo
|
CVE-2024-40725
|
cpe:2.3:a:apache:http_server:2.4.61:*
cpe:2.3:a:apache:http_server:2.4.60:*
|
|
|
|
|
2024-11-21 18:31
2024-07-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5
|
7.5
-
|
HIGH
Network
|
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.
Users are recommended to upgrade to version 2.4.60, whic…
|
-
|
CVE-2024-38477
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.60
|
2024-11-21 18:26
2024-07-2
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
6
|
9.8
-
|
CRITICAL
Network
|
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious o…
|
NVD-CWE-noinfo
|
CVE-2024-38476
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
2.4.60
|
|
|
2024-11-21 18:26
2024-07-2
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
7
|
9.8
-
|
CRITICAL
Network
|
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in
directories permitted by the configuration but not directly reachable by any …
|
-
|
CVE-2024-38474
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.60
|
2024-11-21 18:26
2024-07-2
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
8
|
7.5
-
|
HIGH
Network
|
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory …
|
-
|
CVE-2024-27316
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.17
|
|
|
2.4.59
|
2024-11-21 18:04
2024-04-5
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
9
|
5.9
-
|
MEDIUM
Network
|
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection c…
|
CWE-404
Improper Resource Shutdown or Release
|
CVE-2023-45802
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.17
|
|
|
2.4.58
|
2024-11-21 17:27
2023-10-23
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
10
|
7.5
-
|
HIGH
Network
|
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resou…
|
-
|
CVE-2023-43622
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.55
|
|
|
2.4.58
|
2024-11-21 17:24
2023-10-23
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|