Apache HTTP Server any version

Apache HTTP Server: HTTP/2 DoS by Memory Increase

Apache HTTP Server: mod_http2 denial of service

Apache HTTP Server: mod_dav out of bounds read, or write of zero byte

Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

Apache HTTP Server: mod_macro buffer over-read

Format string bug in the Redis cache implementation

Apache HTTP Server: mod_xml2enc heap overflow

Apache HTTP Server: mod_proxy_html buffer overflow

Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.

Apache HTTP Server: mod_dav_lock indirect lock crash

Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled

Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow

Apache HTTP Server: mod_proxy_http2 denial of service

Apache HTTP Server: SSRF on Windows due to UNC paths

Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF

Apache HTTP Server: SSRF with mod_headers setting Content-Type header

Apache HTTP Server: HTTP response splitting

Apache HTTP Server: mod_ssl error log variable escaping

Apache HTTP Server: mod_md (ACME), unintended retry intervals

Apache HTTP Server: mod_ssl TLS upgrade attack

mod_auth_digest possible stack overflow by one nul byte

Apache HTTP Server: HTTP response splitting

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

Apache HTTP Server: mod_md unrestricted OCSP response

Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.

Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument

The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.

Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

Apache HTTP Server: CGI environment variable override

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.

Apache HTTP Server: HTTP Response Splitting in multiple modules