Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 376

Export CSV
CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 27.0% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Http Server Traffic Server Mac Os X and 25 more
CVE-2024-40898

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. 

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Apache Microsoft Redhat
Products
Http Server Windows Jboss Core Services
CVE-2022-30522

mod_sed denial of service

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

CVSS 3.1 · 7.5 High EPSS 89.9% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Clustered Data Ontap and 3 more
CVE-2022-28614

read beyond bounds via ap_rwrite()

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

CVSS 3.1 · 5.3 Medium EPSS 5.1% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Clustered Data Ontap and 3 more
CVE-2022-22721

core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

CVSS 3.1 · 9.1 Critical EPSS 41.9% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Macos and 8 more
CVE-2022-22720

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CVSS 3.1 · 9.8 Critical EPSS 28.2% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Macos and 13 more
CVE-2022-22719

mod_lua Use of uninitialized value of in r:parsebody

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

CVSS 3.1 · 7.5 High EPSS 69.8% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Macos and 6 more
CVE-2021-44224

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

CVSS 3.1 · 8.2 High EPSS 82.3% KEV · Not listed
Vendors
Apache Apple Debian and 4 more
Products
Http Server Mac Os X Macos and 12 more
CVE-2021-41524

null pointer dereference in h2 fuzzing

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

CVSS 3.1 · 7.5 High EPSS 25.8% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 2 more
Products
Http Server Fedora Cloud Backup and 2 more
CVE-2021-35940

Regression of CVE-2017-12613

An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed
Vendors
Apache Oracle
Products
Portable Runtime Http Server
CVE-2021-32792

XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.

CVSS 3.1 · 3.1 Low EPSS 1.5% KEV · Not listed
Vendors
Apache Fedoraproject Openidc and 1 more
Products
Http Server Fedora Mod Auth Openidc and 1 more
CVE-2021-32791

Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

CVSS 3.1 · 5.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Apache Fedoraproject Openidc and 1 more
Products
Http Server Fedora Mod Auth Openidc and 1 more
CVE-2021-32786

Open Redirect in oidc_validate_redirect_url()

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.

CVSS 3.1 · 4.7 Medium EPSS 2.4% KEV · Not listed
Vendors
Apache Fedoraproject Openidc and 1 more
Products
Http Server Fedora Mod Auth Openidc and 1 more
CVE-2021-32785

Format string bug in the Redis cache implementation

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Apache Debian Netapp and 1 more
Products
Http Server Debian Linux Cloud Backup and 1 more
CVE-2021-31618

NULL pointer dereference on specially crafted HTTP/2 request

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.

CVSS 3.1 · 7.5 High EPSS 52.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 1 more
Products
Http Server Debian Linux Fedora and 3 more
CVE-2021-26691

Apache HTTP Server mod_session response handling heap overflow

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVSS 3.1 · 9.8 Critical EPSS 68.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Http Server Debian Linux Fedora and 7 more