Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 376

Export CSV
CVE-2021-26690

mod_session NULL pointer dereference

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

CVSS 3.1 · 7.5 High EPSS 65.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Http Server Debian Linux Fedora and 5 more
CVE-2020-9490

httpd: Push diary crash on specifically crafted HTTP/2 header

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

CVSS 3.1 · 7.5 High EPSS 88.8% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Http Server Ubuntu Linux Debian Linux and 25 more
CVE-2020-35452

mod_auth_digest possible stack overflow by one nul byte

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

CVSS 3.1 · 7.3 High EPSS 53.2% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Http Server Debian Linux Fedora and 5 more
CVE-2020-1927

httpd: mod_rewrite configurations vulnerable to open redirect

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

CVSS 3.1 · 6.1 Medium EPSS 56.7% KEV · Not listed
Vendors
Apache Broadcom Canonical and 6 more
Products
Http Server Brocade Fabric Operating System Ubuntu Linux and 14 more
CVE-2020-13950

mod_proxy_http NULL pointer dereference

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

CVSS 3.1 · 7.5 High EPSS 50.0% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Http Server Debian Linux Fedora and 5 more
CVE-2020-11985

httpd: IP address spoofing when proxying using mod_remoteip and mod_rewrite

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

CVSS 3.1 · 5.3 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Rhel Software Collections
CVE-2019-17567

mod_proxy_wstunnel tunneling of non Upgraded connections

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

CVSS 3.1 · 5.3 Medium EPSS 59.7% KEV · Not listed
Vendors
Apache Fedoraproject Oracle and 1 more
Products
Http Server Fedora Enterprise Manager Ops Center and 3 more
CVE-2019-10098

httpd: mod_rewrite potential open redirect

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

CVSS 3.1 · 6.1 Medium EPSS 74.0% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Core Services and 1 more
CVE-2019-10097

httpd: null-pointer dereference in mod_remoteip

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

CVSS 3.1 · 7.2 High EPSS 52.9% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Http Server Communications Element Manager Communications Session Report Manager and 8 more
CVE-2019-10092

httpd: limited cross-site scripting in mod_proxy error page

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

CVSS 3.1 · 6.1 Medium EPSS 81.5% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 10 more
CVE-2019-10081

httpd: memory corruption on early pushes

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

CVSS 3.0 · 7.5 High EPSS 14.0% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Http Server Debian Linux Enterprise Linux and 1 more
CVE-2019-0220

httpd: URL normalization inconsistency

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

CVSS 3.0 · 5.3 Medium EPSS 17.9% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Http Server Ubuntu Linux Debian Linux and 5 more
CVE-2019-0217

httpd: mod_auth_digest: access control bypass due to race condition

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

CVSS 3.1 · 7.5 High EPSS 16.4% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 13 more
CVE-2019-0215

httpd: mod_ssl: access control bypass when using per-location client certification authentication

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

CVSS 3.0 · 7.5 High EPSS 10.4% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Http Server Fedora Enterprise Linux
CVE-2019-0197

httpd: mod_http2: possible crash on late upgrade

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

CVSS 3.1 · 4.2 Medium EPSS 8.3% KEV · Not listed
Vendors
Apache Canonical Fedoraproject and 3 more
Products
Http Server Ubuntu Linux Fedora and 9 more
CVE-2019-0196

httpd: mod_http2: read-after-free on a string compare

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

CVSS 3.0 · 5.3 Medium EPSS 19.3% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Http Server Ubuntu Linux Debian Linux and 2 more