Vulnerabilities > Apache > Http Server

DATE CVE VULNERABILITY TITLE RISK
2024-07-18 CVE-2024-40725 Unspecified vulnerability in Apache Http Server 2.4.60/2.4.61
A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers.
network
low complexity
apache
5.3
2024-07-18 CVE-2024-40898 Server-Side Request Forgery (SSRF) vulnerability in Apache Http Server
SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. 
network
low complexity
apache CWE-918
7.5
2024-07-01 CVE-2024-38474 Improper Encoding or Escaping of Output vulnerability in multiple products
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
network
low complexity
apache netapp CWE-116
critical
9.8
2024-07-01 CVE-2024-38476 Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
network
low complexity
apache netapp
critical
9.8
2024-07-01 CVE-2024-38477 NULL Pointer Dereference vulnerability in multiple products
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
network
low complexity
apache netapp CWE-476
7.5
2024-04-04 CVE-2024-27316 Allocation of Resources Without Limits or Throttling vulnerability in multiple products
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response.
network
low complexity
apache fedoraproject netapp CWE-770
7.5
2023-10-23 CVE-2023-31122 Out-of-bounds Read vulnerability in multiple products
Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
network
low complexity
apache fedoraproject CWE-125
7.5
2023-10-23 CVE-2023-43622 Resource Exhaustion vulnerability in Apache Http Server 2.4.55
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server.
network
low complexity
apache CWE-400
7.5
2023-10-23 CVE-2023-45802 Resource Exhaustion vulnerability in multiple products
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately.
network
high complexity
apache fedoraproject CWE-400
5.9
2023-03-07 CVE-2023-25690 HTTP Request Smuggling vulnerability in Apache Http Server
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution.
network
low complexity
apache CWE-444
critical
9.8