Product by Apache Software Foundation

    Apache HTTP Server

    154 known vulnerabilities in Apache HTTP Server (Apache Software Foundation), 5 of them actively exploited (CISA KEV).

    Key figures

    154

    Vulnerabilities

    5

    Actively exploited (KEV)

    3

    Used by ransomware

    32

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Apache HTTP Server (Apache Software Foundation)
    CriticalCVE-2021-41773

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    In CISA KEVRansomwarealso in 5 other products

    		9.8
    CriticalCVE-2021-42013

    Apache HTTP Server Path Traversal Vulnerability

    In CISA KEVRansomwarealso in 7 other products

    		9.8
    CriticalCVE-2021-40438

    mod_proxy SSRF

    In CISA KEVRansomwarealso in 40 other products

    		9.0
    CriticalCVE-2024-38475

    Apache HTTP Server Improper Escaping of Output Vulnerability

    In CISA KEValso in 10 other products

    		9.1
    CriticalCVE-2019-0211

    Apache HTTP Server Privilege Escalation Vulnerability

    In CISA KEValso in 27 other products

    		7.8
    HighCVE-2026-49975

    Apache HTTP Server: mod_http2 denial of service

    also in 6 other products

    		7.5
    HighCVE-2026-23918

    Apache HTTP Server: http2: double free and possible RCE on early reset

    also in 5 other products

    		8.8
    CriticalCVE-2024-38476

    Apache HTTP Server: Inclusion of Functionality from Untrusted Control Sphere

    also in 4 other products

    		9.8
    CriticalCVE-2023-25690

    Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

    also in 4 other products

    		9.8
    CriticalCVE-2021-44790

    Apache HTTP Server: Out-of-bounds Write

    also in 16 other products

    		9.8
    CriticalCVE-2020-11984

    Apache HTTP Server: Remote Code Execution

    also in 13 other products

    		9.8
    CriticalCVE-2021-26691

    Apache HTTP Server mod_session response handling heap overflow

    also in 10 other products

    		9.8
    CriticalCVE-2022-23943

    mod_sed: Read/write beyond bounds

    also in 6 other products

    		9.8
    CriticalCVE-2021-39275

    ap_escape_quotes buffer overflow

    also in 13 other products

    		9.8
    CriticalCVE-2017-7679

    Apache HTTP Server: Buffer Over-read

    also in 2 other products

    		9.8
    CriticalCVE-2022-22720

    HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

    also in 9 other products

    		9.8
    CriticalCVE-2017-3167

    Apache HTTP Server: Improper Authentication

    also in 15 other products

    		9.8
    CriticalCVE-2017-3169

    Apache HTTP Server: NULL Pointer Dereference

    also in 2 other products

    		9.8
    CriticalCVE-2018-1312

    Apache HTTP Server: security vulnerability

    also in 14 other products

    		9.8
    CriticalCVE-2017-9788

    Apache HTTP Server: Denial of Service

    also in 16 other products

    		9.1
    CriticalCVE-2022-22721

    core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

    also in 9 other products

    		9.1
    HighCVE-2024-38473

    Apache HTTP Server proxy encoding problem

    also in 4 other products

    		8.1
    HighCVE-2024-38472

    Apache HTTP Server on WIndows UNC SSRF

    also in 3 other products

    		7.5
    HighCVE-2024-27316

    Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

    also in 5 other products

    		7.5
    CriticalCVE-2019-10082

    Apache HTTP Server: security vulnerability

    also in 6 other products

    		9.1

    All vulnerabilities in search

    News

    All products by Apache Software Foundation