Apache Software Foundation Apache HTTP Server

• CVE-2025-65082 Medium 6.5 Apache HTTP Server: CGI environment variable override 0.9%
• CVE-2025-59775 High 7.5 Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF 0.9%
• CVE-2025-55753 High 7.5 Apache HTTP Server: mod_md (ACME), unintended retry intervals 0.5%
• CVE-2025-54090 Medium 6.3 Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64 0.9%
• CVE-2025-53020 High 7.5 Apache HTTP Server: HTTP/2 DoS by Memory Increase 5.0%
• CVE-2025-49812 High 7.4 Apache HTTP Server: mod_ssl TLS upgrade attack 0.6%
• CVE-2025-49630 High 7.5 Apache HTTP Server: mod_proxy_http2 denial of service 1.4%
• CVE-2025-23048 Critical 9.1 Apache HTTP Server: mod_ssl access control bypass with session resumption 1.0%
• CVE-2024-43394 High 7.5 Apache HTTP Server: SSRF on Windows due to UNC paths 1.3%
• CVE-2024-47252 High 7.5 Apache HTTP Server: mod_ssl error log variable escaping 0.8%
• CVE-2024-43204 High 7.5 Apache HTTP Server: SSRF with mod_headers setting Content-Type header 0.9%
• CVE-2024-42516 High 7.5 Apache HTTP Server: HTTP response splitting 0.8%
• CVE-2024-40725 Medium 5.3 Apache HTTP Server: source code disclosure with handlers configured via AddType 4.4%
• CVE-2024-40898 Critical 9.1 Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows 1.6%
• CVE-2024-39884 Medium 6.2 Apache HTTP Server: source code disclosure with handlers configured via AddType 0.9%
• CVE-2024-39573 High 7.5 Apache HTTP Server: mod_rewrite proxy handler substitution 35.4%
• CVE-2024-38477 High 7.5 Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request 3.2%
• CVE-2024-38476 Critical 9.8 Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect 41.6%
• CVE-2024-38474 High 8.1 Apache HTTP Server weakness with encoded question marks in backreferences 2.5%
• CVE-2024-38473 High 8.1 Apache HTTP Server proxy encoding problem 25.9%
• CVE-2024-38472 High 7.5 Apache HTTP Server on WIndows UNC SSRF 69.5%
• CVE-2024-36387 Medium 5.4 Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 1.7%
• CVE-2024-27316 High 7.5 Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames 88.8%
• CVE-2024-24795 Medium 6.3 Apache HTTP Server: HTTP Response Splitting in multiple modules 2.9%
• CVE-2023-38709 High 7.3 Apache HTTP Server: HTTP response splitting 3.9%
• CVE-2023-31122 Unrated Apache HTTP Server: mod_macro buffer over-read 3.0%
• CVE-2023-43622 Unrated Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 68.8%
• CVE-2023-45802 Unrated Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST 3.2%
• CVE-2023-27522 High 7.5 Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting 2.1%
• CVE-2023-25690 Critical 9.8 Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy 84.5%
• CVE-2022-37436 Medium 5.3 Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting 52.7%
• CVE-2022-36760 Critical 9.0 Apache HTTP Server: mod_proxy_ajp Possible request smuggling 1.9%
• CVE-2022-31813 Unrated mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism 3.5%
• CVE-2022-30556 Unrated Information Disclosure in mod_lua with websockets 5.4%
• CVE-2022-30522 Unrated mod_sed denial of service 89.9%
• CVE-2022-29404 Unrated Denial of service in mod_lua r:parsebody 6.6%
• CVE-2022-28615 Critical 9.1 Read beyond bounds in ap_strcmp_match() 6.5%
• CVE-2022-28614 Unrated read beyond bounds via ap_rwrite() 5.1%
• CVE-2022-28330 Unrated read beyond bounds in mod_isapi 3.9%
• CVE-2022-26377 Unrated mod_proxy_ajp: Possible request smuggling 21.1%
• CVE-2022-23943 Unrated mod_sed: Read/write beyond bounds 50.4%
• CVE-2022-22721 Unrated core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody 41.9%
• CVE-2022-22720 Unrated HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier 28.2%
• CVE-2022-22719 Unrated mod_lua Use of uninitialized value of in r:parsebody 69.8%
• CVE-2021-44224 Unrated Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier 82.3%
• CVE-2021-44790 Unrated Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier 96.8%
• CVE-2021-41524 Unrated null pointer dereference in h2 fuzzing 25.8%
• CVE-2021-39275 Unrated ap_escape_quotes buffer overflow 39.4%
• CVE-2021-36160 Unrated mod_proxy_uwsgi out of bound read 63.7%
• CVE-2021-34798 Unrated NULL pointer dereference in httpd core 64.5%