Apache HTTP Server
- Software type
- Web server
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/13/2026, Apache HTTP Server recorded 23 security vulnerabilities in the last 90 days, of which 16 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache HTTP Server and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-119618Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headersCVE-2026-109163Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)CVE-2026-106023Apache HTTP Server: mod_md NULL pointer dereference leads to child process crashCVE-2026-93546Apache Software Foundation Apache HTTP Server mod_dav_fs integer overflow causes worker crashes and property database corruptionCVE-2026-79768Apache HTTP Server: mod_userdir information disclosure| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-119618Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-109163Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292) | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityUnknown |
|---|
CVE-2026-106023Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityUnknown |
|---|
CVE-2026-93546Apache Software Foundation Apache HTTP Server mod_dav_fs integer overflow causes worker crashes and property database corruption | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-79768Apache HTTP Server: mod_userdir information disclosure | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-73637Apache HTTP Server: mod_auth_digest DoS attack | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-73636Apache HTTP Server: mod_auth_digest one-time-nonce replay attack | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-63718Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-63686Apache HTTP Server: mod_xml2enc crash on charset conversion failure | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-63292Apache HTTP Server: mod_vhost_alias stack overflow | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-63045Apache HTTP Server: mod_proxy_ftp PASV address handling | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-59797Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityCritical |
|---|
CVE-2026-59685Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-58415Apache HTTP Server: mod_dav_fs property database read access | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-57941Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityCritical |
|---|
CVE-2026-56449Apache HTTP Server: mod_proxy_html: crash in dump_content | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-56154Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityCritical |
|---|
CVE-2026-56153Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-48005Apache HTTP Server: mod_auth_digest reauthentication attack | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-47360Apache HTTP Server: mod_session: Session cookie not removed during internal redirect | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-46729Apache HTTP Server: mod_heartmonitor denial of service | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-42528Apache HTTP Server: mod_dav shared lock overflow | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-42356Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityLow |
|---|
CVE-2026-49975Apache HTTP Server: mod_http2 denial of service | Exploitation statusActively exploited | FixYes | Published06/08/2026 | SeverityHigh |
|---|
CVE-2026-48913Apache HTTP Server: mod_http2 memory corruption when file handles exhausted | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityHigh |
|---|
CVE-2026-44631Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityCritical |
|---|
CVE-2026-44186Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityHigh |
|---|
CVE-2026-44185Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityHigh |
|---|
CVE-2026-44119Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityMedium |
|---|
CVE-2026-43951Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityMedium |
|---|
CVE-2026-42536Apache HTTP Server: mod_xml2enc heap overflow | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityHigh |
|---|
CVE-2026-42535Apache HTTP Server: mod_dav_fs protected directory access | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityCritical |
|---|
CVE-2026-34356Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityHigh |
|---|
CVE-2026-34355Apache HTTP Server: mod_proxy_html buffer overflow | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityHigh |
|---|
CVE-2026-29170Apache HTTP Server: mod_proxy_ftp XSS | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityMedium |
|---|
CVE-2026-29167Apache HTTP Server: mod_ldap per-dir use-after-free | Exploitation statusNot exploited | FixYes | Published06/08/2026 | SeverityCritical |
|---|
CVE-2026-29168Apache HTTP Server: mod_md unrestricted OCSP response | Exploitation statusNot exploited | FixYes | Published05/05/2026 | SeverityHigh |
|---|
CVE-2026-28780Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() | Exploitation statusNot exploited | FixYes | Published05/05/2026 | SeverityCritical |
|---|
CVE-2026-34059Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityHigh |
|---|
CVE-2026-34032Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityMedium |
|---|
CVE-2026-33857Apache HTTP Server: Off-by-one OOB reads in AJP getter functions | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityMedium |
|---|
CVE-2026-33523Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityMedium |
|---|
CVE-2026-33007Apache HTTP Server: mod_authn_socache crash | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityMedium |
|---|
CVE-2026-33006Apache HTTP Server: mod_auth_digest timing attack | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityMedium |
|---|
CVE-2026-29169Apache HTTP Server: mod_dav_lock indirect lock crash | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityHigh |
|---|
CVE-2026-24072Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityHigh |
|---|
CVE-2026-23918Apache HTTP Server: http2: double free and possible RCE on early reset | Exploitation statusNot exploited | FixYes | Published05/04/2026 | SeverityHigh |
|---|
CVE-2025-66200Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo | Exploitation statusNot exploited | FixYes | Published12/05/2025 | SeverityMedium |
|---|
CVE-2025-65082Apache HTTP Server: CGI environment variable override | Exploitation statusNot exploited | FixYes | Published12/05/2025 | SeverityMedium |
|---|
CVE-2025-59775Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF | Exploitation statusNot exploited | FixYes | Published12/05/2025 | SeverityHigh |
|---|
132 Results | Page 1 of 3