Apache: >> Http Server >> 2.4.23 Security Vulnerabilities
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
9.8
EPSS Score
0.006
Published
2026-10-01
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-10-01
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...})
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
9.8
EPSS Score
0.006
Published
2026-10-01
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.
This issue affects Apache HTTP Server version 2.4.68.
CVSS Score
7.5
EPSS Score
0.006
Published
2026-10-01
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.006
Published
2026-10-01
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-10-01
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.
This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
CVSS Score
3.7
EPSS Score
0.005
Published
2026-10-01
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.
Users are recommended to upgrade to version 2.4.69, which fixes this issue
CVSS Score
4.3
EPSS Score
0.004
Published
2026-10-01
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.
This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
CVSS Score
7.5
EPSS Score
0.042
Published
2026-06-08
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
CVSS Score
6.5
EPSS Score
0.01
Published
2026-06-08