httpd

3 results · Clear filters · Feed

• Critical 9.1
  CVE-2025-23048 Public exploit

  Apache HTTP Server: mod_ssl access control bypass with session resumption

  In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• Critical 9.8
  CVE-2023-25690 Public exploit EPSS 84%

  Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

  Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Mar 7, 2023
• Critical 9.0
  CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  mod_proxy SSRF

  A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Sep 16, 2021

  KEV Dec 1, 2021