Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Apache HTTP Server Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Published	Severity

`CVE-2026-49975`Apache HTTP Server: mod_http2 denial of service	Exploitation statusPublic exploit	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-48913`Apache HTTP Server: mod_http2 memory corruption when file handles exhausted	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-42536`Apache HTTP Server: mod_xml2enc heap overflow	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-44185`Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-34355`Apache HTTP Server: mod_proxy_html buffer overflow	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-44631`Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityCritical
`CVE-2026-44119`Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityMedium
`CVE-2026-43951`Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityMedium
`CVE-2026-42535`Apache HTTP Server: mod_dav_fs protected directory access	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityCritical
`CVE-2026-34356`Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-44186`Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-29170`Apache HTTP Server: mod_proxy_ftp XSS	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityMedium
`CVE-2026-29167`Apache HTTP Server: mod_ldap per-dir use-after-free	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityCritical
`CVE-2026-28780`Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()	Exploitation statusNot known exploited	FixYes	Published05/05/2026	SeverityCritical
`CVE-2026-29168`Apache HTTP Server: mod_md unrestricted OCSP response	Exploitation statusNot known exploited	FixYes	Published05/05/2026	SeverityHigh
`CVE-2026-29169`Apache HTTP Server: mod_dav_lock indirect lock crash	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityHigh
`CVE-2026-23918`Apache HTTP Server: http2: double free and possible RCE on early reset	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityHigh
`CVE-2026-33006`Apache HTTP Server: mod_auth_digest timing attack	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityMedium
`CVE-2026-33007`Apache HTTP Server: mod_authn_socache crash	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityMedium
`CVE-2026-33523`Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityMedium
`CVE-2026-33857`Apache HTTP Server: Off-by-one OOB reads in AJP getter functions	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityMedium
`CVE-2026-34032`Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityMedium
`CVE-2026-34059`Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityHigh
`CVE-2026-24072`Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr	Exploitation statusNot known exploited	FixYes	Published05/04/2026	SeverityHigh
`CVE-2025-58098`Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...	Exploitation statusNot known exploited	FixYes	Published12/05/2025	SeverityHigh
`CVE-2025-66200`Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo	Exploitation statusNot known exploited	FixYes	Published12/05/2025	SeverityMedium
`CVE-2025-65082`Apache HTTP Server: CGI environment variable override	Exploitation statusNot known exploited	FixYes	Published12/05/2025	SeverityMedium
`CVE-2025-59775`Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF	Exploitation statusNot known exploited	FixYes	Published12/05/2025	SeverityHigh
`CVE-2025-55753`Apache HTTP Server: mod_md (ACME), unintended retry intervals	Exploitation statusNot known exploited	FixYes	Published12/05/2025	SeverityHigh
`CVE-2025-54090`Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64	Exploitation statusNot known exploited	FixYes	Published07/23/2025	SeverityMedium
`CVE-2025-53020`Apache HTTP Server: HTTP/2 DoS by Memory Increase	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityHigh
`CVE-2025-49812`Apache HTTP Server: mod_ssl TLS upgrade attack	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityHigh
`CVE-2025-49630`Apache HTTP Server: mod_proxy_http2 denial of service	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityHigh
`CVE-2025-23048`Apache HTTP Server: mod_ssl access control bypass with session resumption	Exploitation statusPublic exploit	FixYes	Published07/10/2025	SeverityCritical
`CVE-2024-43394`Apache HTTP Server: SSRF on Windows due to UNC paths	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityHigh
`CVE-2024-47252`Apache HTTP Server: mod_ssl error log variable escaping	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityHigh
`CVE-2024-43204`Apache HTTP Server: SSRF with mod_headers setting Content-Type header	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityHigh
`CVE-2024-42516`Apache HTTP Server: HTTP response splitting	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityHigh
`CVE-2024-40725`Apache HTTP Server: source code disclosure with handlers configured via AddType	Exploitation statusNot known exploited	FixYes	Published07/18/2024	SeverityMedium
`CVE-2024-40898`Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows	Exploitation statusNot known exploited	FixYes	Published07/18/2024	SeverityCritical
`CVE-2024-39884`Apache HTTP Server: source code disclosure with handlers configured via AddType	Exploitation statusNot known exploited	FixNot confirmed	Published07/04/2024	SeverityMedium
`CVE-2024-39573`Apache HTTP Server: mod_rewrite proxy handler substitution	Exploitation statusNot known exploited	FixYes	Published07/01/2024	SeverityHigh
`CVE-2024-38477`Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request	Exploitation statusNot known exploited	FixYes	Published07/01/2024	SeverityHigh
`CVE-2024-38476`Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect	Exploitation statusNot known exploited	FixYes	Published07/01/2024	SeverityCritical
`CVE-2024-38475`Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.	Exploitation statusKEV	FixYes	Published07/01/2024	SeverityCritical
`CVE-2024-38474`Apache HTTP Server weakness with encoded question marks in backreferences	Exploitation statusNot known exploited	FixYes	Published07/01/2024	SeverityHigh
`CVE-2024-38473`Apache HTTP Server proxy encoding problem	Exploitation statusNot known exploited	FixYes	Published07/01/2024	SeverityHigh
`CVE-2024-38472`Apache HTTP Server on WIndows UNC SSRF	Exploitation statusNot known exploited	FixYes	Published07/01/2024	SeverityHigh
`CVE-2024-36387`Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2	Exploitation statusNot known exploited	FixYes	Published07/01/2024	SeverityMedium
`CVE-2024-27316`Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames	Exploitation statusNot known exploited	FixYes	Published04/04/2024	SeverityHigh
`CVE-2024-24795`Apache HTTP Server: HTTP Response Splitting in multiple modules	Exploitation statusNot known exploited	FixYes	Published04/04/2024	SeverityMedium
`CVE-2023-38709`Apache HTTP Server: HTTP response splitting	Exploitation statusNot known exploited	FixYes	Published04/04/2024	SeverityHigh
`CVE-2023-31122`Apache HTTP Server: mod_macro buffer over-read	Exploitation statusNot known exploited	FixYes	Published10/23/2023	SeverityUnknown
`CVE-2023-43622`Apache HTTP Server: DoS in HTTP/2 with initial windows size 0	Exploitation statusPublic exploit	FixYes	Published10/23/2023	SeverityUnknown
`CVE-2023-45802`Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST	Exploitation statusNot known exploited	FixYes	Published10/23/2023	SeverityUnknown
`CVE-2023-27522`Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting	Exploitation statusNot known exploited	FixYes	Published03/07/2023	SeverityHigh
`CVE-2023-25690`Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy	Exploitation statusPublic exploit	FixNot confirmed	Published03/07/2023	SeverityCritical
`CVE-2022-37436`Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting	Exploitation statusNot known exploited	FixYes	Published01/17/2023	SeverityMedium
`CVE-2022-36760`Apache HTTP Server: mod_proxy_ajp Possible request smuggling	Exploitation statusNot known exploited	FixYes	Published01/17/2023	SeverityCritical
`CVE-2006-20001`Apache HTTP Server: mod_dav out of bounds read, or write of zero byte	Exploitation statusNot known exploited	FixYes	Published01/17/2023	SeverityUnknown
`CVE-2022-31813`mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism	Exploitation statusNot confirmed	FixNot confirmed	Published06/08/2022	SeverityUnknown
`CVE-2022-30556`Information Disclosure in mod_lua with websockets	Exploitation statusNot confirmed	FixNot confirmed	Published06/08/2022	SeverityUnknown
`CVE-2022-30522`mod_sed denial of service	Exploitation statusNot confirmed	FixNot confirmed	Published06/08/2022	SeverityUnknown
`CVE-2022-29404`Denial of service in mod_lua r:parsebody	Exploitation statusNot confirmed	FixNot confirmed	Published06/08/2022	SeverityUnknown
`CVE-2022-28615`Read beyond bounds in ap_strcmp_match()	Exploitation statusNot known exploited	FixNot confirmed	Published06/08/2022	SeverityCritical
`CVE-2022-28614`read beyond bounds via ap_rwrite()	Exploitation statusNot confirmed	FixNot confirmed	Published06/08/2022	SeverityUnknown
`CVE-2022-28330`read beyond bounds in mod_isapi	Exploitation statusNot confirmed	FixNot confirmed	Published06/08/2022	SeverityUnknown
`CVE-2022-26377`mod_proxy_ajp: Possible request smuggling	Exploitation statusNot confirmed	FixNot confirmed	Published06/08/2022	SeverityUnknown
`CVE-2022-23943`mod_sed: Read/write beyond bounds	Exploitation statusNot confirmed	FixNot confirmed	Published03/14/2022	SeverityUnknown
`CVE-2022-22721`core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody	Exploitation statusNot confirmed	FixNot confirmed	Published03/14/2022	SeverityUnknown
`CVE-2022-22720`HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier	Exploitation statusNot confirmed	FixNot confirmed	Published03/14/2022	SeverityUnknown
`CVE-2022-22719`mod_lua Use of uninitialized value of in r:parsebody	Exploitation statusNot confirmed	FixNot confirmed	Published03/14/2022	SeverityUnknown
`CVE-2021-44224`Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier	Exploitation statusNot confirmed	FixYes	Published12/20/2021	SeverityUnknown
`CVE-2021-44790`Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier	Exploitation statusNot confirmed	FixYes	Published12/20/2021	SeverityUnknown
`CVE-2021-42013`Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)	Exploitation statusKEV	FixNot confirmed	Published10/07/2021	SeverityCritical
`CVE-2021-41773`Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49	Exploitation statusKEV	FixYes	Published10/05/2021	SeverityHigh
`CVE-2021-41524`null pointer dereference in h2 fuzzing	Exploitation statusNot confirmed	FixYes	Published10/05/2021	SeverityUnknown
`CVE-2021-40438`mod_proxy SSRF	Exploitation statusKEV	FixNot confirmed	Published09/16/2021	SeverityCritical
`CVE-2021-39275`ap_escape_quotes buffer overflow	Exploitation statusNot confirmed	FixNot confirmed	Published09/16/2021	SeverityUnknown
`CVE-2021-36160`mod_proxy_uwsgi out of bound read	Exploitation statusNot confirmed	FixNot confirmed	Published09/16/2021	SeverityUnknown
`CVE-2021-34798`NULL pointer dereference in httpd core	Exploitation statusNot confirmed	FixNot confirmed	Published09/16/2021	SeverityUnknown
`CVE-2021-33193`Request splitting via HTTP/2 method injection and mod_proxy	Exploitation statusNot confirmed	FixNot confirmed	Published08/16/2021	SeverityUnknown
`CVE-2021-31618`NULL pointer dereference on specially crafted HTTP/2 request	Exploitation statusNot known exploited	FixNot confirmed	Published06/15/2021	SeverityUnknown
`CVE-2021-30641`Unexpected URL matching with 'MergeSlashes OFF'	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2021	SeverityUnknown
`CVE-2021-26691`Apache HTTP Server mod_session response handling heap overflow	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2021	SeverityUnknown
`CVE-2021-26690`mod_session NULL pointer dereference	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2021	SeverityUnknown
`CVE-2020-35452`mod_auth_digest possible stack overflow by one nul byte	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2021	SeverityUnknown
`CVE-2020-13950`mod_proxy_http NULL pointer dereference	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2021	SeverityUnknown
`CVE-2020-13938`Improper Handling of Insufficient Privileges	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2021	SeverityUnknown
`CVE-2019-17567`mod_proxy_wstunnel tunneling of non Upgraded connections	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2021	SeverityUnknown
`CVE-2019-0197`	Exploitation statusNot confirmed	FixNot confirmed	Published06/11/2019	SeverityUnknown
`CVE-2019-0196`	Exploitation statusNot confirmed	FixNot confirmed	Published06/11/2019	SeverityUnknown
`CVE-2019-0220`	Exploitation statusNot confirmed	FixNot confirmed	Published06/11/2019	SeverityUnknown
`CVE-2018-17189`	Exploitation statusNot confirmed	FixNot confirmed	Published01/30/2019	SeverityUnknown
`CVE-2018-17199`	Exploitation statusNot confirmed	FixNot confirmed	Published01/30/2019	SeverityUnknown
`CVE-2019-0190`	Exploitation statusNot confirmed	FixNot confirmed	Published01/30/2019	SeverityUnknown
`CVE-2018-11763`	Exploitation statusNot confirmed	FixNot confirmed	Published09/25/2018	SeverityUnknown
`CVE-2016-4975`mod_userdir CRLF injection	Exploitation statusNot confirmed	FixYes	Published08/14/2018	SeverityUnknown
`CVE-2018-8011`mod_md, DoS via Coredumps on specially crafted requests	Exploitation statusNot confirmed	FixYes	Published07/18/2018	SeverityUnknown
`CVE-2018-1333`DoS for HTTP/2 connections by crafted requests	Exploitation statusNot confirmed	FixYes	Published06/18/2018	SeverityUnknown

100 / 119 Results

Security vulnerabilities in Apache HTTP Server

Apache HTTP Server

How many security vulnerabilities does Apache HTTP Server currently have?

Does the latest version of Apache HTTP Server have any known vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management