Product by Apache Software Foundation
Apache HTTP Server
352 known vulnerabilities in Apache HTTP Server (Apache Software Foundation), 6 of them actively exploited (CISA KEV).
Key figures
352
Vulnerabilities
6
Actively exploited (KEV)
3
Used by ransomware
35
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2021-41773 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-40438 | mod_proxy SSRF In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2024-38475 | Apache HTTP Server Improper Escaping of Output Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2019-0211 | Apache HTTP Server Privilege Escalation Vulnerability In CISA KEV | 7.8 | |
| High | CVE-2026-23918 | Apache HTTP Server: http2: double free and possible RCE on early reset | 8.8 | |
| High | CVE-2026-49975 | Apache HTTP Server: mod_http2 denial of service | 7.5 | |
| Critical | CVE-2024-38476 | Apache HTTP Server: Inclusion of Functionality from Untrusted Control Sphere | 9.8 | |
| Critical | CVE-2023-25690 | Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy | 9.8 | |
| Critical | CVE-2021-44790 | Apache HTTP Server: Out-of-bounds Write | 9.8 | |
| Critical | CVE-2020-11984 | Apache HTTP Server: Remote Code Execution | 9.8 | |
| Critical | CVE-2009-3555 | OpenSSL: security vulnerability | 9.8 | |
| Critical | CVE-2021-26691 | Apache HTTP Server mod_session response handling heap overflow | 9.8 | |
| Critical | CVE-2022-23943 | mod_sed: Read/write beyond bounds | 9.8 | |
| Critical | CVE-2021-39275 | ap_escape_quotes buffer overflow | 9.8 | |
| Critical | CVE-2017-7679 | Apache HTTP Server: Buffer Over-read | 9.8 | |
| Critical | CVE-2022-22720 | HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier | 9.8 | |
| Critical | CVE-2017-3167 | Apache HTTP Server: Improper Authentication | 9.8 | |
| Critical | CVE-2017-3169 | Apache HTTP Server: NULL Pointer Dereference | 9.8 | |
| Critical | CVE-2018-1312 | Apache HTTP Server: security vulnerability | 9.8 | |
| Critical | CVE-2022-22721 | core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody | 9.1 | |
| Critical | CVE-2017-9788 | Apache HTTP Server: Denial of Service | 9.1 | |
| High | CVE-2024-38473 | Apache HTTP Server proxy encoding problem | 8.1 | |
| High | CVE-2024-38472 | Apache HTTP Server on WIndows UNC SSRF | 7.5 |
News
- HTTP/2 Bomb CVE-2026-49975fortinet-psirt,
- New CitrixBleed-like NetScaler flaw sees exploit attempts in the wildcsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 23sans-atrisk-mail,
- HTTP/2’s speed abused to slow webserver performance in DoS attackcsoonline,