2.4.56

DATE	CVE	VULNERABILITY TITLE	RISK
2024-07-18	CVE-2024-40898	Unspecified vulnerability in Apache Http Server SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. network low complexity apache	7.5
2024-07-01	CVE-2024-38474	Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. network low complexity apache netapp critical	9.8
2024-07-01	CVE-2024-38476	Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue. network low complexity apache netapp critical	9.8
2024-07-01	CVE-2024-38477	null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue. network low complexity apache netapp	7.5
2024-04-04	CVE-2024-27316	HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. network low complexity apache fedoraproject netapp	7.5
2023-10-23	CVE-2023-31122	Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. network low complexity apache fedoraproject	7.5
2023-10-23	CVE-2023-43622	Unspecified vulnerability in Apache Http Server 2.4.55/2.4.56/2.4.57 An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. network low complexity apache	7.5
2023-10-23	CVE-2023-45802	Improper Resource Shutdown or Release vulnerability in multiple products When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. network high complexity apache fedoraproject debian CWE-404	5.9