CVE-2023-25690

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.

CVSS 3.1 · 9.8 Critical EPSS 84.0% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Jboss Core Services and 5 more

CVE-2022-28615

Read beyond bounds in ap_strcmp_match()

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.

CVSS 3.1 · 9.1 Critical EPSS 6.5% KEV · Not listed

Vendors

Apache Fedoraproject Netapp and 1 more

Products

Http Server Fedora Clustered Data Ontap and 3 more

CVE-2025-59775

Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF

Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Microsoft

Products

Http Server Windows

CVE-2025-65082

Apache HTTP Server: CGI environment variable override

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Http Server

CVE-2025-66200

Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Http Server

CVE-2025-55753

Apache HTTP Server: mod_md (ACME), unintended retry intervals

An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Http Server

CVE-2024-38475

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

CVSS 3.1 · 9.1 Critical EPSS 100.0% KEV · Listed

Vendors

Apache Netapp Redhat and 1 more

Products

Http Server Ontap 9 Enterprise Linux and 16 more

CVE-2024-36387

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

CVSS 3.1 · 5.4 Medium EPSS 1.7% KEV · Not listed

Vendors

Apache Netapp Redhat

Products

Http Server Ontap Enterprise Linux and 1 more

CVE-2025-54090

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Http Server

CVE-2025-53020

Apache HTTP Server: HTTP/2 DoS by Memory Increase

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed

Vendors

Apache

Products

Apache Http Server Http Server

CVE-2025-49812

Apache HTTP Server: mod_ssl TLS upgrade attack

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Http Server Apache Http Server

CVE-2025-49630

Apache HTTP Server: mod_proxy_http2 denial of service

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Apache

Products

Apache Http Server Http Server

CVE-2024-47252

Apache HTTP Server: mod_ssl error log variable escaping

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apache Http Server Http Server

CVE-2024-43394

Apache HTTP Server: SSRF on Windows due to UNC paths

Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via  mod_rewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note:  The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths. The server offers limited protection against administrators directing the server to open UNC paths. Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Apache Microsoft

Products

Apache Http Server Http Server Windows

CVE-2024-43204

Apache HTTP Server: SSRF with mod_headers setting Content-Type header

SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request. Users are recommended to upgrade to version 2.4.64 which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Http Server Apache Http Server

CVE-2024-42516

Apache HTTP Server: HTTP response splitting

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apache Http Server Http Server

CVE-2024-27316

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

CVSS 3.1 · 7.5 High EPSS 88.8% KEV · Not listed

Vendors

Apache Fedoraproject Netapp and 1 more

Products

Http Server Fedora Ontap and 4 more

CVE-2023-38709

Apache HTTP Server: HTTP response splitting

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

CVSS 3.1 · 7.3 High EPSS 3.9% KEV · Not listed

Vendors

Apache Apple Broadcom and 4 more

Products

Http Server Macos Fabric Operating System and 6 more

CVE-2017-9798

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

CVSS 3.1 · 7.5 High EPSS 94.7% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Http Server Debian Linux Enterprise Linux and 5 more

CVE-2017-3167

httpd: ap_get_basic_auth_pw() authentication bypass

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

CVSS 3.1 · 9.8 Critical EPSS 20.2% KEV · Not listed

Vendors

Apache Apple Debian and 3 more

Products

Http Server Mac Os X Debian Linux and 14 more