Apache HTTP Server: mod_proxy_html: crash in dump_content

Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

Apache HTTP Server: mod_auth_digest reauthentication attack

Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

Apache HTTP Server: mod_heartmonitor denial of service

Apache HTTP Server: mod_http2 denial of service

Apache HTTP Server: mod_xml2enc heap overflow

Apache HTTP Server: mod_proxy_html buffer overflow

Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow

Apache HTTP Server: mod_dav_lock indirect lock crash

Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF

Apache HTTP Server: mod_md (ACME), unintended retry intervals

Apache HTTP Server: HTTP/2 DoS by Memory Increase

Apache HTTP Server: mod_proxy_http2 denial of service

Apache HTTP Server: SSRF on Windows due to UNC paths

Apache HTTP Server: mod_ssl error log variable escaping

Apache HTTP Server: SSRF with mod_headers setting Content-Type header

Apache HTTP Server: HTTP response splitting

Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

Apache HTTP Server: mod_rewrite proxy handler substitution

Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

Apache HTTP Server on WIndows UNC SSRF

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent

Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory…

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input…

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP…

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS)

Malformed requests may cause the server to dereference a NULL pointer

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1…

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial…

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and…

Apache HTTP Server versions 2.4.20 to 2.4.43

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong…

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to…

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate…

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured…

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session

A bug exists in the way mod_ssl handled client renegotiations

By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault