Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Apache HTTP Server Number Of NVD 283 CRITICAL 22 HIGH 92 MEDIUM 156 LOW 13
URL https://httpd.apache.org/
Explanation It is the most widely used web server software in the world, and is used for everything from large commercial sites to home servers. It is also referred to simply as Apache.

The above text is excerpted from "https://ja.wikipedia.org/wiki/Apache_HTTP_Server".

It has become one of the open source combinations called LAMP (Linux, Apache, MySQL [MariaDB], PHP).
Tag
  • Apache License v2.0
  • オープンソース
Add Information URL
No Type Name URL
1 https://httpd.apache.org/download.cgi
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
31 Apache HTTP Server 2.4 2.4.66 Dec. 4, 2025 Feb. 21, 2012 19 33 33 1
32 Apache HTTP Server 2.0 2.0.65 July 10, 2013 April 6, 2002 July 10, 2013 8 28 72 5
33 Apache HTTP Server 2.3 2.3.9 7 9 8 0
34 Apache HTTP Server 2.2 2.2.9 11 20 68 7
35 Apache HTTP Server 2.1 2.1.9 8 9 12 0
36 Apache HTTP Server 2.0 2.0.9 8 21 53 4
37 Apache HTTP Server 12.2 12.2.1.3.0 0 0 0 0
38 Apache HTTP Server 12.1 12.1.3.0.0 0 0 0 0
39 Apache HTTP Server 11.1 11.1.1.9.0 0 0 0 0
40 Apache HTTP Server 1.99 1.99 8 11 11 0
41 Apache HTTP Server 1.4 1.4.0 8 11 11 0
42 Apache HTTP Server 1.3 1.3.9 9 27 42 3
43 Apache HTTP Server 1.2 1.2.9 8 16 18 0
44 Apache HTTP Server 1.15 1.15.17 8 12 11 0
45 Apache HTTP Server 1.1 1.1.1 8 18 19 0
46 Apache HTTP Server 1.0 1.0.5 8 17 19 0
47 Apache HTTP Server 0.8 0.8.14 8 16 18 0
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
31 7.5
5.0 		HIGH
Network 		While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request.… CWE-476
 NULL Pointer Dereference 		CVE-2021-41524 cpe:2.3:a:apache:http_server:2.4.49:* 2024-11-21 15:26
2021-10-5 		Show GitHub Exploit DB Packet Storm
32 9.8
7.5 		CRITICAL
Network 		ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affe… CWE-787
 Out-of-bounds Write 		CVE-2021-39275 cpe:2.3:a:apache:http_server:*:* 2.4.48 2024-11-21 15:19
2021-09-17 		Show GitHub Exploit DB Packet Storm
33 9.0
6.8 		CRITICAL
Network 		A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. CWE-918
Server-Side Request Forgery (SSRF)  		CVE-2021-40438 cpe:2.3:a:apache:http_server:*:* 2.4.48 2024-11-21 15:24
2021-09-17 		Show GitHub Exploit DB Packet Storm
34 7.5
5.0 		HIGH
Network 		A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive). CWE-125
Out-of-bounds Read 		CVE-2021-36160 cpe:2.3:a:apache:http_server:*:* 2.4.30 2.4.48 2024-11-21 15:13
2021-09-17 		Show GitHub Exploit DB Packet Storm
35 7.5
5.0 		HIGH
Network 		Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. CWE-476
 NULL Pointer Dereference 		CVE-2021-34798 cpe:2.3:a:apache:http_server:*:* 2.4.48 2024-11-21 15:11
2021-09-17 		Show GitHub Exploit DB Packet Storm
36 7.5
5.0 		HIGH
Network 		A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.… NVD-CWE-Other
CVE-2021-33193 cpe:2.3:a:apache:http_server:*:* 2.4.17 2.4.48 2024-11-21 15:08
2021-08-16 		Show GitHub Exploit DB Packet Storm
37 7.5
5.0 		HIGH
Network 		Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On viol… CWE-476
 NULL Pointer Dereference 		CVE-2021-31618 cpe:2.3:a:apache:http_server:2.4.47:*
cpe:2.3:a:apache:http_server:1.15.17:* 		2024-11-21 15:06
2021-06-15 		Show GitHub Exploit DB Packet Storm
38 5.3
5.0 		MEDIUM
Network 		Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' NVD-CWE-Other
CVE-2021-30641 cpe:2.3:a:apache:http_server:*:* 2.4.39 2.4.46 2024-11-21 15:04
2021-06-10 		Show GitHub Exploit DB Packet Storm
39 9.8
7.5 		CRITICAL
Network 		In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow CWE-787
 Out-of-bounds Write 		CVE-2021-26691 cpe:2.3:a:apache:http_server:*:* 2.4.0 2.4.46 2024-11-21 14:56
2021-06-10 		Show GitHub Exploit DB Packet Storm
40 7.5
5.0 		HIGH
Network 		Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service CWE-476
 NULL Pointer Dereference 		CVE-2021-26690 cpe:2.3:a:apache:http_server:*:* 2.4.0 2.4.46 2024-11-21 14:56
2021-06-10 		Show GitHub Exploit DB Packet Storm