Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache HTTP Server

139 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-23048 Public exploit

    Apache HTTP Server: mod_ssl access control bypass with session resumption

    In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2024-40898 Public exploit

    Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

    SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. 

    Apache Software Foundation Apache HTTP Server apache2 Alpine
  • Critical 9.8
    CVE-2024-38476 Public exploit EPSS 42%

    Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2024-38475 Exploited Public exploit EPSS 100%

    Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

    Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV May 1, 2025
  • Critical 9.8
    CVE-2023-25690 Public exploit EPSS 85%

    Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

    Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2021-42013 Exploited · Ransomware Public exploit EPSS 100%

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2021-40438 Exploited · Ransomware Public exploit EPSS 100%

    mod_proxy SSRF

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV Dec 1, 2021