Apache HTTP Server vulnerabilities

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. This acceptance of different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers.

Apache HTTP Server through 2.4.23 does not protect applications from untrusted client data in the HTTP_PROXY environment variable, allowing remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.

Apache HTTP Server versions 2.4.18 to 2.4.20, when mod_http2 and mod_ssl are enabled, improperly recognize the 'SSLVerifyClient require' directive for HTTP/2 request authorization. This allows remote attackers to bypass intended access restrictions.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

A partial fix for CVE-2024-39884 in Apache HTTP Server 2.4.61 ignores some legacy content-type based configurations like AddType. Under certain circumstances with indirect file requests, this can lead to source code disclosure of local content.

Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

In Apache HTTP Server's mod_ssl from 2.4.0 through 2.4.68, improper privilege management via SSLRequire and file-related expressions may lead to unauthorized access.

In Apache HTTP Server's mod_http2 from 2.4.0 through 2.4.68, a Use After Free vulnerability exists via shared session->bbtmp re-entrancy.

In Apache HTTP Server's mod_rewrite from 2.4.0 through 2.4.68, a Use After Free vulnerability exists when using lookahead (%{LA-U:HTTP:...}).

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

A memory allocation with excessive size vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. Affects versions 2.4.17 through 2.4.67.

Buffer Underwrite vulnerability in Apache HTTP Server when processing crafted regular expressions in configuration. Affects versions 2.4.0 through 2.4.67.

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Apache HTTP Server versions 2.4.0 through 2.4.67 have a Use After Free vulnerability in mod_ldap with per-directory configuration. This can lead to undefined behavior.

Heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server, that server can send a crafted AJP message causing a write of 4 attacker-controlled bytes beyond the end of a heap buffer.

A double free vulnerability in Apache HTTP Server when handling HTTP/2 protocol may lead to remote code execution (RCE). This issue affects version 2.4.66.

The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 does not protect applications from untrusted CGI client data in the HTTP_PROXY environment variable. This may allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.

mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.

The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory. Remote attackers can read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL.

Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir). This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

A use after free exists in mod_auth_digest in Apache HTTP Server before 2.4.69 on all platforms. An unauthenticated remote client can cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.

In mod_proxy_ftp of Apache HTTP Server through 2.4.68, improper validation of the PASV reply address allows an untrusted FTP server, in forward proxy configurations, to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.

In Apache HTTP Server on Windows, processing paths with 8.3 names that may grow when expanded leads to an out-of-bounds write vulnerability. Affects versions from 2.4.0 through 2.4.68.

In mod_dav_fs of Apache HTTP Server before 2.4.69, internal state files are accessible to external parties. A remote client can read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory.

In Apache HTTP Server's mod_proxy_html from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists when processing crafted HTTP response bodies.

In Apache HTTP Server's mod_charset_lite from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists.

In mod_auth_digest of Apache HTTP Server before 2.4.69, missing authentication checks allow an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

NULL Pointer Dereference vulnerability in Apache HTTP Server's mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server from 2.4.0 through 2.4.68.

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server from 2.4.60 through 2.4.68.

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.