Apache HTTP Server vulnerabilities

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. This acceptance of different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers.

Apache HTTP Server through 2.4.23 does not protect applications from untrusted client data in the HTTP_PROXY environment variable, allowing remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.

Apache HTTP Server versions 2.4.18 to 2.4.20, when mod_http2 and mod_ssl are enabled, improperly recognize the 'SSLVerifyClient require' directive for HTTP/2 request authorization. This allows remote attackers to bypass intended access restrictions.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content.

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

A partial fix for CVE-2024-39884 in Apache HTTP Server 2.4.61 ignores some legacy content-type based configurations like AddType. Under certain circumstances with indirect file requests, this can lead to source code disclosure of local content.

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served but not directly reachable, leading to code execution or source code disclosure.

Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.

A memory allocation with excessive size vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. Affects versions 2.4.17 through 2.4.67.

Buffer Underwrite vulnerability in Apache HTTP Server when processing crafted regular expressions in configuration. Affects versions 2.4.0 through 2.4.67.

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Apache HTTP Server versions 2.4.0 through 2.4.67 have a Use After Free vulnerability in mod_ldap with per-directory configuration. This can lead to undefined behavior.

Heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server, that server can send a crafted AJP message causing a write of 4 attacker-controlled bytes beyond the end of a heap buffer.

A double free vulnerability in Apache HTTP Server when handling HTTP/2 protocol may lead to remote code execution (RCE). This issue affects version 2.4.66.

The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 does not protect applications from untrusted CGI client data in the HTTP_PROXY environment variable. This may allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.

Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.

A vulnerability in Apache HTTP Server causes a buffer leak for requests with a body when reading the body may result in reading 0 bytes. This is particularly the case for 100-Continue requests, but also for any request with slow network connections.

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

Use After Free vulnerability in Apache HTTP Server mod_http2 in versions 2.4.55-2.4.67. Occurs when file handles are exhausted.

An infinite loop vulnerability in the mod_proxy_ftp module in Apache HTTP Server from 2.4.0 through 2.4.67, exploitable when an attacker controls the backend FTP server. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker-controlled OCSP server. Affects versions 2.4.0 through 2.4.67.

Apache HTTP Server 2.4.67 and earlier has an Improper Privilege Management vulnerability that allows local .htaccess authors to read files with the privileges of the httpd user.

Apache HTTP Server versions 2.4.0 through 2.4.67 contain an out-of-bounds read vulnerability in mod_headers and mod_mime when handling multiple response languages. The vulnerability can be exploited remotely.

A heap-based buffer overflow vulnerability exists in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content. This affects versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Heap-based buffer overflow vulnerability in Apache HTTP Server from version 2.4.0 through 2.4.67. It can be exploited by malicious backend servers and ProxyPassReverseCookie* directives.

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier. An attacker can exploit an untrusted backend.

In Apache HTTP Server 2.4.67 and earlier, a cross-site scripting (XSS) vulnerability exists in mod_proxy_ftp's HTML directory list generation when listing FTP directory contents via forward or reverse proxy configuration.