Apache HTTP Server vulnerabilities

71 known vulnerabilities in Apache HTTP Server from Apache. 71 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Apache HTTP Server: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-119618Nov 11, 2026ApacheEPSS 1.33%

  Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from Gi

• 8.8 High severity

  Apache HTTP Server: Integer Overflow or Wraparound

  CVE-2026-93546Oct 1, 2026Apache

  Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

• 7.3 High severity

  Apache HTTP Server: Use After Free

  CVE-2026-73637Oct 1, 2026Apache

  Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCh

• 8.1 High severity

  Apache HTTP Server: Authentication Bypass by Capture-replay

  CVE-2026-73636Oct 1, 2026Apache

  Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger

• 7.5 High severity

  Apache HTTP Server: Inconsistent Interpretation of HTTP Requests

  CVE-2026-63718Oct 1, 2026Apache

  Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30

• 7.5 High severity

  Apache HTTP Server: NULL Pointer Dereference

  CVE-2026-63686Oct 1, 2026Apache

  A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds

• 7.5 High severity

  Apache HTTP Server: Stack-based Buffer Overflow

  CVE-2026-63292Oct 1, 2026Apache

  Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exc

• 7.5 High severity

  Apache HTTP Server: Improper Access Control

  CVE-2026-63045Oct 1, 2026Apache

  Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an

• 9.8 Critical severity

  Apache HTTP Server: Improper Privilege Management

  CVE-2026-59797Oct 1, 2026Apache

  Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

• 7.5 High severity

  Apache HTTP Server: Out-of-bounds Write

  CVE-2026-59685Oct 1, 2026Apache

  Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

• 9.8 Critical severity

  Apache HTTP Server: Use After Free

  CVE-2026-57941Oct 1, 2026Apache

  Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

• 7.5 High severity

  Apache HTTP Server: Out-of-bounds Write

  CVE-2026-56449Oct 1, 2026Apache

  Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.

• 9.8 Critical severity

  Apache HTTP Server: Use After Free

  CVE-2026-56154Oct 1, 2026Apache

  Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

• 7.5 High severity

  Apache HTTP Server: Missing Authentication for Critical Functionality

  CVE-2026-48005Oct 1, 2026Apache

  Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers wh

• 7.5 High severity

  Apache HTTP Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-47360Oct 1, 2026Apache

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affec

• 7.5 High severity

  Apache HTTP Server: NULL Pointer Dereference

  CVE-2026-46729Oct 1, 2026Apache

  NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

• 7.5 High severity

  Apache HTTP Server: Memory Allocation with Excessive Size Value

  CVE-2026-49975Jun 8, 2026ApacheEPSS 33%

  Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

• 7.3 High severity

  Apache HTTP Server: Use After Free

  CVE-2026-48913Jun 8, 2026Apache

  Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

• 9.8 Critical severity

  Apache HTTP Server: Buffer Underwrite

  CVE-2026-44631Jun 8, 2026Apache

  Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

• 7.3 High severity

  Apache HTTP Server: Loop with Unreachable Exit Condition

  CVE-2026-44186Jun 8, 2026Apache

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to

• 7.3 High severity

  Apache HTTP Server: Buffer Over-read

  CVE-2026-44185Jun 8, 2026Apache

  Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

• 7.5 High severity

  Apache HTTP Server: Heap-based Buffer Overflow

  CVE-2026-42536Jun 8, 2026ApacheEPSS 1.02%

  Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

• 9.1 Critical severity

  Apache HTTP Server: Exposure of Resource to Wrong Sphere

  CVE-2026-42535Jun 8, 2026Apache

  A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes th

• 7.5 High severity

  Apache HTTP Server: Heap-based Buffer Overflow

  CVE-2026-34356Jun 8, 2026Apache

  Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issu

• 7.5 High severity

  Apache HTTP Server: Heap-based Buffer Overflow

  CVE-2026-34355Jun 8, 2026ApacheEPSS 1.16%

  A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

• 9.8 Critical severity

  Apache HTTP Server: Use After Free

  CVE-2026-29167Jun 8, 2026Apache

  Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

• 8.1 High severity

  Apache HTTP Server: Heap-based Buffer Overflow

  CVE-2026-28780May 5, 2026ApacheEPSS 1.38%

  Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after

• 7.3 High severity

  Apache HTTP Server: Allocation of Resources Without Limits or Throttling

  CVE-2026-29168May 5, 2026Apache

  Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the iss

• 7.5 High severity

  Apache HTTP Server: NULL Pointer Dereference

  CVE-2026-29169May 4, 2026Apache

  A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mo

• 8.8 High severity

  Apache HTTP Server: Double Free

  CVE-2026-23918May 4, 2026ApacheEPSS 49.7%

  Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• 7.5 High severity

  Apache HTTP Server: Buffer Over-read

  CVE-2026-34059May 4, 2026Apache

  Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• 8.8 High severity

  Apache HTTP Server: Improper Privilege Management

  CVE-2026-24072May 4, 2026Apache

  An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

• 8.3 High severity

  Apache HTTP Server: Insertion of Sensitive Information Into Sent Data

  CVE-2025-58098Dec 5, 2025ApacheEPSS 1.53%

  Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgr

• 7.5 High severity

  Apache HTTP Server: Server-Side Request Forgery

  CVE-2025-59775Dec 5, 2025Apache

  Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to

• 7.5 High severity

  Apache HTTP Server: Integer Overflow or Wraparound

  CVE-2025-55753Dec 5, 2025Apache

  An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. Th

• 7.5 High severity

  Apache HTTP Server: Missing Release of Memory after Effective Lifetime

  CVE-2025-53020Jul 10, 2025ApacheEPSS 4.96%

  Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

• 7.4 High severity

  Apache HTTP Server: Improper Authentication

  CVE-2025-49812Jul 10, 2025Apache

  In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgr

• 7.5 High severity

  Apache HTTP Server: Reachable Assertion

  CVE-2025-49630Jul 10, 2025ApacheEPSS 1.35%

  In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured fo

• 9.1 Critical severity

  Apache HTTP Server: Improper Access Control

  CVE-2025-23048Jul 10, 2025ApacheEPSS 1.04%

  In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with eac

• 7.5 High severity

  Apache HTTP Server: Improper Neutralization of Escape, Meta, or Control Sequences

  CVE-2024-47252Jul 10, 2025Apache

  Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{var