Apache HTTP Server vulnerabilities

A vulnerability in Apache HTTP Server causes a buffer leak for requests with a body when reading the body may result in reading 0 bytes. This is particularly the case for 100-Continue requests, but also for any request with slow network connections.

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

Use After Free vulnerability in Apache HTTP Server mod_http2 in versions 2.4.55-2.4.67. Occurs when file handles are exhausted.

An infinite loop vulnerability in the mod_proxy_ftp module in Apache HTTP Server from 2.4.0 through 2.4.67, exploitable when an attacker controls the backend FTP server. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker-controlled OCSP server. Affects versions 2.4.0 through 2.4.67.

Apache HTTP Server 2.4.67 and earlier has an Improper Privilege Management vulnerability that allows local .htaccess authors to read files with the privileges of the httpd user.

Apache HTTP Server versions 2.4.0 through 2.4.67 contain an out-of-bounds read vulnerability in mod_headers and mod_mime when handling multiple response languages. The vulnerability can be exploited remotely.

A heap-based buffer overflow vulnerability exists in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content. This affects versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Heap-based buffer overflow vulnerability in Apache HTTP Server from version 2.4.0 through 2.4.67. It can be exploited by malicious backend servers and ProxyPassReverseCookie* directives.

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier. An attacker can exploit an untrusted backend.

In Apache HTTP Server 2.4.67 and earlier, a cross-site scripting (XSS) vulnerability exists in mod_proxy_ftp's HTML directory list generation when listing FTP directory contents via forward or reverse proxy configuration.

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66.

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

A Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows potential leakage of NTLM hashes to a malicious server via SSRF and malicious requests or content. Users are recommended to upgrade to version 2.4.66.