Apache Http Server
Monthly
Denial of service in Apache HTTP Server releases before 2.4.69, where the mod_xml2enc filter dereferences a NULL pointer when a proxied response declares a charset whose conversion partially succeeds and then fails, crashing the handling child process. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the crash is reachable without credentials over the network, but exploitation is gated by a trust boundary: the request path must run proxied backend responses through mod_xml2enc (in practice mod_proxy_html content rewriting), and the attacker must control or have compromised that upstream backend server - ordinary external clients cannot directly trigger it. Impact is limited to availability (worker/child process termination with no confidentiality or integrity effect), and no public exploit code, KEV listing, or EPSS score was provided at time of analysis, so this is best treated as a low-to-moderate priority hardening item for reverse-proxy deployments that transform untrusted upstream content.
An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database by sending PROPPATCH requests that declare a large number of XML namespaces. The flaw is a CWE-190 integer overflow; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms the attacker must be authenticated with write permissions, and impact is limited to denial of service and property database integrity, with no code execution, privilege escalation, or data disclosure. No CVSS score, EPSS probability, KEV listing, or public exploit code is present in the provided data, so there is no confirmed active exploitation and no public exploit identified at time of analysis.
Concurrent Digest authentication requests against Apache HTTP Server before 2.4.69 can corrupt authentication state via a use-after-free in the mod_auth_digest module, yielding low integrity and availability impact with no confidentiality impact (per the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Unauthenticated remote clients can reach the flaw, but exploitation is gated by two non-default preconditions: AuthDigestNcCheck must be enabled or AuthDigestNonceLifetime set to 0, and the attacker must win a timing-dependent race by sending concurrent Digest requests - serial requests will not reliably trigger it. There is no public exploit identified at time of analysis, no EPSS score, no CISA KEV entry, and no vendor-supplied CVSS, so the sole source is the Apache advisory; the fix is version 2.4.69.
Authentication bypass in the mod_auth_digest module of Apache HTTP Server 2.4.x allows a man-in-the-middle attacker to capture a victim's HTTP Digest authentication credentials and replay them to impersonate that user against the server. Exploitation is conditional: the server must have mod_auth_digest enabled and the non-default directive AuthDigestNonceLifetime must be explicitly set to 0, and the attacker must additionally occupy a network interception position to capture the digest exchange and send crafted requests that force garbage collection of the client's shared-memory nonce entry. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects high confidentiality impact but a high attack-complexity and MITM prerequisite; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the source supplied no CVSS score or EPSS estimate.
Inconsistent interpretation of HTTP responses in Apache HTTP Server's mod_proxy_uwsgi module lets a crafted backend uwsgi response that carries a Transfer-Encoding header be parsed differently by Apache than by the backend, enabling HTTP response smuggling and desynchronization between the proxy and downstream clients. Affected deployments are Apache HTTP Server 2.4.30 through 2.4.68 configured as a reverse proxy to a uwsgi backend via mod_proxy_uwsgi; installations that do not load or use mod_proxy_uwsgi are not affected. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) is network-reachable by unauthenticated remote attackers, but exploitation is gated by high complexity because the attacker must control or influence the backend uwsgi response - typically through a malicious or compromised backend application, or a response-header-injection flaw in it - so this is not reachable against a default Apache install. No public exploit code has been identified and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is limited to low confidentiality and low integrity with a scope change, not full remote code execution or denial of service.
Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthenticated client to crash the server or potentially execute arbitrary code by sending an HTTP request whose Host header exceeds 8192 bytes. The flaw is not reachable in default deployments: the operator must have configured VirtualDocumentRoot (or VirtualScriptAlias) with a hostname format specifier such as %0 or %1 and must have raised LimitRequestFieldSize above its 8192-byte default, a non-default and uncommon combination that is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No KEV listing, EPSS score, or public exploit code was available at time of analysis, so there is no public exploit identified at time of analysis; the dominant uncertainty is the absence of any quantitative exploitation signal, while the real-world exploitability is sharply constrained by the required operator-set configuration. Users are advised to upgrade to 2.4.69, which fixes the issue.
Forward proxy deployments of Apache HTTP Server through 2.4.68 that relay FTP traffic can be manipulated by an untrusted FTP server into opening a data connection to an arbitrary third-party host, because mod_proxy_ftp fails to validate the address returned in an FTP PASV reply. Only non-default configurations with forward proxying enabled (ProxyRequests On) and mod_proxy_ftp loaded are affected, and the primary impact is a misdirected outbound data connection rather than compromise of the proxy host itself. No KEV entry, EPSS score, or POC was supplied and no public exploit has been identified at time of analysis, so prioritization signals are limited and authentication requirements are not confirmed from the supplied data.
Improper privilege management in Apache HTTP Server's mod_ssl (versions 2.4.0 through 2.4.68) causes SSLRequire access-control directives that use file-related expressions to be evaluated in a way that can grant or deny access contrary to the server operator's intent, giving a remote attacker a possible means to reach content that the SSLRequire check was meant to protect or, conversely, to disrupt intended authorization. The flaw is not reachable in a default configuration: exploitation requires mod_ssl to be loaded and the operator to have configured access control specifically through the SSLRequire directive using file-related expressions, a non-default, operator-chosen configuration, which is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (high attack complexity, low confidentiality and integrity impact, no availability impact); authentication requirements for the attacker are not confirmed from available data. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided.
An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processes request paths containing MS-DOS 8.3 short filenames that expand to longer names, giving a remote attacker a route to service disruption (assessed availability impact High) with limited confidentiality and integrity impact. Exploitation is Windows-only and conditional: 8.3 short-name generation must be enabled on the underlying NTFS volume (the historical default unless NtfsDisable8dot3NameCreation has been set) and the crafted path must actually reach the expanding-path code path, which is reflected in the assessed vector's AC:H. Apache published no CVSS score, and the supplied intelligence contains no CISA KEV listing, no public exploit code, and no EPSS probability, so there is no public exploit identified at time of analysis.
Use-after-free in Apache HTTP Server's mod_http2 module (versions 2.4.0 through 2.4.68) allows unauthenticated remote attackers to corrupt memory and crash server worker processes by driving re-entrant access to a shared per-session buffer. The flaw only manifests when mod_http2 is loaded and HTTP/2 is actually enabled (h2 and/or h2c in the Protocols directive), and the trigger requires specific concurrent/streamed HTTP/2 request patterns, so the assessed vector is network-reachable but high complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact limited to availability. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied.
An out-of-bounds write in Apache HTTP Server's mod_proxy_html output filter affects versions 2.4.0 through 2.4.68 and can be triggered by a crafted HTML response body that the server parses and rewrites while proxying upstream content. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates remote unauthenticated attackers can reach the flaw, but high attack complexity reflects a significant deployment prerequisite: mod_proxy_html must be explicitly loaded and actively rewriting proxied HTML, which is not a default configuration, and the attacker must be able to influence the upstream/backend response body being processed. The result is memory corruption with low confidentiality and integrity impact and a high availability impact, and no public exploit has been identified at the time of analysis; servers used solely as origin web servers, or proxies that do not enable mod_proxy_html, are not affected.
Denial of service in Apache HTTP Server 2.4.0 through 2.4.68 arises from a use-after-free in the mod_rewrite module that is reachable only when a RewriteRule or RewriteCond uses the lookahead variables %{LA-U:...} or %{LA-F:...}, which exercise an internal subrequest code path. An unauthenticated remote attacker who can reach a server configured that way can trigger the memory error and crash request-handling processes, degrading or halting service; the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is confined to availability and the high attack complexity combined with the non-default configuration prerequisite substantially limits real-world exploitability. No CVSS score or vector has been published by NVD or the vendor, there is no EPSS probability and no CISA KEV listing, and no public exploit code has been identified at time of analysis.
An out-of-bounds write in Apache HTTP Server's optional mod_charset_lite module (affecting versions 2.4.0 through 2.4.68) can corrupt process memory when character-set translation is configured, potentially crashing the server or enabling limited data disclosure or modification. Exposure is narrow: mod_charset_lite is not loaded in default installations and must be explicitly enabled and bound to a content path via directives such as CharsetSourceEnc, CharsetDefault, or an associated input/output filter, which is why the assessed vector rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Independent signals are otherwise sparse - no public exploit code, no CISA KEV listing, and no EPSS score were available - so no public exploit identified at time of analysis, and the practical severity hinges on whether the module is deployed.
Apache HTTP Server before 2.4.69 can be forced into repeated re-authentication by unauthenticated remote attackers sending forged Authorization headers when Digest authentication is enabled with the non-default AuthDigestNcCheck directive. Successful exploitation causes a limited availability impact, denial of service through forced re-authentication, without compromising data confidentiality or integrity. No public exploit code was identified at time of analysis, and the flaw is constrained to the uncommon Digest-auth-plus-AuthDigestNcCheck configuration.
Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to trigger memory corruption when the server's file handle pool is exhausted. The flaw carries a CVSS 7.3 (low impact across confidentiality, integrity, and availability) and is reachable over the network without authentication or user interaction, though no public exploit identified at time of analysis. Tagging emphasizes denial-of-service and memory corruption as the primary realistic outcomes.
Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server by submitting untrusted XML content processed by the mod_xml2enc module's xml2StartParse function. The flaw is a CWE-122 heap-based buffer overflow with a CVSS 7.5 score reflecting high availability impact only, and no public exploit has been identified at time of analysis.
Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limited integrity and availability impact via outbound OCSP requests sent to an attacker-controlled OCSP responder. The flaw stems from improper bounds handling (CWE-126) when parsing OCSP response data, and currently shows no public exploit identified at time of analysis despite a CVSS 7.3 rating reflecting unauthenticated network reachability with low complexity.
Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html output filter, where a malicious or compromised backend can return crafted HTML that corrupts memory in the proxying httpd worker. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated network exploitation with availability-only impact, and no public exploit was identified at time of analysis.
Apache HTTP Server 2.4.0-2.4.67 has a buffer underwrite (CWE-124) in ap_regname, triggered by a crafted regular expression in the server configuration. The vendor (Apache) rates this Low severity. A separate CISA-ADP assessment assigned CVSS 9.8 using a network, unauthenticated vector that is inconsistent with the vendor description, because exploitation requires control over the httpd configuration. No public exploit and not in CISA KEV. Fixed in 2.4.68.
Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author to directly manipulate trusted DAV property databases, leading to integrity violations and child process crashes. With a CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N) and SSVC technical impact rated 'total' with automatable=yes, the flaw is highly impactful, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered when the server processes responses from a malicious backend while ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath directives are in use. Remote attackers controlling or compromising an upstream backend can crash the front-end Apache process, impacting availability of the reverse proxy without affecting confidentiality or integrity. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from an infinite loop condition in the mod_proxy_ftp module when interacting with an attacker-controlled backend FTP server. Remote attackers can degrade availability and partially impact confidentiality and integrity without authentication, though exploitation requires a proxied request path to a malicious FTP backend. No public exploit identified at time of analysis, and EPSS is very low at 0.02%.
Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition in mod_ldap when LDAP authentication or authorization is configured in a per-directory context. The CVSS 9.8 rating reflects unauthenticated network exploitation with high impact across confidentiality, integrity, and availability, though no public exploit has been identified at time of analysis and EPSS exploitation probability remains very low at 0.02%. CISA SSVC assesses exploitation status as none but flags the issue as automatable with total technical impact.
Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying to attacker-controlled AJP backends. Affects all versions through 2.4.66; attackers can achieve remote code execution by sending malicious AJP protocol responses that overflow a heap buffer with 4 controlled bytes. Apache released patch in version 2.4.67. Despite critical CVSS 9.8, EPSS probability remains very low (0.02%, 5th percentile) indicating minimal observed exploitation attempts, and no CISA KEV listing confirms active in-the-wild abuse. Exploitation requires specific proxy_ajp deployment configuration connecting to malicious AJP servers.
Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhaust server resources via malformed OCSP response data, affecting versions 2.4.30 through 2.4.66. The vulnerability enables attackers to achieve confidentiality, integrity, and availability impacts with low complexity exploitation over the network. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack surface and lack of authentication requirement make this a credible threat requiring prompt patching to version 2.4.67.
Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL pointer dereference in mod_dav_lock, causing denial of service. The vulnerability affects only servers with mod_dav_lock enabled, a legacy module whose primary use-case (Apache Subversion < 1.2.0) is obsolete in modern deployments. CISA SSVC indicates no active exploitation, but the attack is automatable against susceptible configurations. CVSS 7.5 (High) reflects network-accessible, unauthenticated denial of service, though real-world impact is limited to the small subset of servers still running mod_dav_lock.
Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation allows authenticated attackers to compromise server integrity and confidentiality with high impact. Vendor-released patch 2.4.67 addresses the issue. No public exploit or active exploitation confirmed at time of analysis, but SSVC framework rates technical impact as total, indicating complete system compromise potential.
Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network scale. Attackers can read sensitive memory content without authentication or user interaction, achieving high confidentiality impact with low attack complexity. EPSS exploitation probability and KEV status not provided, but SSVC framework confirms the vulnerability is automatable with partial technical impact and no active exploitation detected at time of analysis. Patch released in version 2.4.67.
Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2.4.66 and earlier. The vulnerability requires low-privilege authenticated access to create or modify .htaccess files, but exploits misconfigured module interactions to bypass intended access controls. Apache has released version 2.4.67 to address this issue. SSVC assessment indicates no active exploitation and non-automatable attack vector, with EPSS data not yet available for this recent disclosure.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 arises from a path-equivalence flaw (CWE-55, '/./' single-dot directory) in the mod_userdir module, which mishandles the single-dot directory segment when the UserDir directive is configured with an absolute, non-wildcard path. Only deployments that load mod_userdir and use that specific second syntax form (for example 'UserDir /some/absolute/path') are exposed; servers on the default wildcard/username form, or without mod_userdir loaded, are unaffected regardless of version, so the practical exposure surface is a non-default configuration. The issue is network-reachable over HTTP and is assessed as low-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code or confirmed active exploitation has been identified at time of analysis, and no patch version is specified in the available advisory data.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 allows an unauthenticated remote client to read WebDAV dead properties of resources it cannot author by sending an HTTP GET request to the module's internal .DAV state directory. The flaw is in mod_dav_fs (CWE-552, files or directories accessible to external parties) and is reachable only when mod_dav and mod_dav_fs are loaded with WebDAV enabled and the .DAV state directory is web-accessible, so no default configuration is affected. No public exploit identified at time of analysis, and there is no CISA KEV listing; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a read-only, low-confidentiality leak of client-set metadata with no integrity, availability, or code-execution impact.
Privilege escalation in Apache HTTP Server 2.4.0 through 2.4.67 allows local users with .htaccess write access to read arbitrary files using the privileges of the httpd daemon process, exploiting improper privilege management (CWE-269). The attack vector is local, requires low privileges, and impacts only confidentiality - no integrity or availability impact is present. No public exploit code and no active exploitation have been identified; SSVC classifies technical impact as partial and the vulnerability as non-automatable, consistent with the targeted, local nature of the attack.
Out-of-bounds read in Apache HTTP Server 2.4.0 through 2.4.67 arises from an interaction between mod_headers, mod_mime, and multi-language content negotiation, allowing unauthenticated remote attackers to trigger memory reads beyond allocated buffer boundaries. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) confirms low-complexity, unauthenticated network exploitation yielding limited confidentiality and integrity impact with no availability consequence. No active exploitation confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-site scripting in Apache HTTP Server's mod_proxy_ftp module allows a network-accessible attacker to inject malicious scripts into HTML directory listings generated when the server proxies FTP directory contents. Affected are all versions of Apache HTTP Server up to and including 2.4.67, in both forward and reverse proxy configurations. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the Changed scope (S:C) in the CVSS vector means injected scripts execute in victims' browsers under the origin of the proxy host, elevating the effective impact beyond the medium base score.
Timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows remote unauthenticated attackers to bypass Digest authentication with high attack complexity. The vulnerability exploits measurable timing differences in digest credential validation, enabling credential compromise without valid authentication. Apache has released patched version 2.4.67; no active exploitation has been confirmed, but CISA SSVC framework indicates automatable exploitation is not feasible due to the timing attack's sensitivity requirements.
Null pointer dereference in mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows unauthenticated remote attackers to crash child processes in caching forward proxy configurations, resulting in denial of service. The vulnerability has CVSS 5.3 (medium) with network accessibility and no authentication required, but is limited to partial availability impact affecting only specific proxy deployments. Vendor-released patch: version 2.4.67.
HTTP response splitting in Apache HTTP Server 2.4.0 through 2.4.66 allows remote attackers to inject arbitrary HTTP headers and content when the server acts as a proxy to untrusted or compromised backend servers, enabling cache poisoning, session fixation, and cross-site scripting attacks. CVSS 6.5 (moderate) with network attack vector, no authentication required, and confirmed automatable exploitation per CISA SSVC framework. Vendor-released patch: version 2.4.67.
Out-of-bounds read in mod_proxy_ajp of Apache HTTP Server through version 2.4.66 allows remote unauthenticated attackers to disclose sensitive information via a crafted AJP protocol request. The vulnerability has a CVSS score of 5.3 (moderate) with no active exploitation confirmed. Upgrade to version 2.4.67 to remediate.
Improper null termination and out-of-bounds read vulnerability in Apache HTTP Server through version 2.4.66 allows remote unauthenticated attackers to trigger information disclosure with low complexity exploitation. The vulnerability has a CVSS score of 5.3 (medium) with network-accessible attack vector and no user interaction required, though technical impact is limited to confidentiality (partial information disclosure). Vendor-released patch: version 2.4.67 addresses the issue.
Denial of service in Apache HTTP Server releases before 2.4.69, where the mod_xml2enc filter dereferences a NULL pointer when a proxied response declares a charset whose conversion partially succeeds and then fails, crashing the handling child process. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the crash is reachable without credentials over the network, but exploitation is gated by a trust boundary: the request path must run proxied backend responses through mod_xml2enc (in practice mod_proxy_html content rewriting), and the attacker must control or have compromised that upstream backend server - ordinary external clients cannot directly trigger it. Impact is limited to availability (worker/child process termination with no confidentiality or integrity effect), and no public exploit code, KEV listing, or EPSS score was provided at time of analysis, so this is best treated as a low-to-moderate priority hardening item for reverse-proxy deployments that transform untrusted upstream content.
An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database by sending PROPPATCH requests that declare a large number of XML namespaces. The flaw is a CWE-190 integer overflow; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms the attacker must be authenticated with write permissions, and impact is limited to denial of service and property database integrity, with no code execution, privilege escalation, or data disclosure. No CVSS score, EPSS probability, KEV listing, or public exploit code is present in the provided data, so there is no confirmed active exploitation and no public exploit identified at time of analysis.
Concurrent Digest authentication requests against Apache HTTP Server before 2.4.69 can corrupt authentication state via a use-after-free in the mod_auth_digest module, yielding low integrity and availability impact with no confidentiality impact (per the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Unauthenticated remote clients can reach the flaw, but exploitation is gated by two non-default preconditions: AuthDigestNcCheck must be enabled or AuthDigestNonceLifetime set to 0, and the attacker must win a timing-dependent race by sending concurrent Digest requests - serial requests will not reliably trigger it. There is no public exploit identified at time of analysis, no EPSS score, no CISA KEV entry, and no vendor-supplied CVSS, so the sole source is the Apache advisory; the fix is version 2.4.69.
Authentication bypass in the mod_auth_digest module of Apache HTTP Server 2.4.x allows a man-in-the-middle attacker to capture a victim's HTTP Digest authentication credentials and replay them to impersonate that user against the server. Exploitation is conditional: the server must have mod_auth_digest enabled and the non-default directive AuthDigestNonceLifetime must be explicitly set to 0, and the attacker must additionally occupy a network interception position to capture the digest exchange and send crafted requests that force garbage collection of the client's shared-memory nonce entry. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects high confidentiality impact but a high attack-complexity and MITM prerequisite; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the source supplied no CVSS score or EPSS estimate.
Inconsistent interpretation of HTTP responses in Apache HTTP Server's mod_proxy_uwsgi module lets a crafted backend uwsgi response that carries a Transfer-Encoding header be parsed differently by Apache than by the backend, enabling HTTP response smuggling and desynchronization between the proxy and downstream clients. Affected deployments are Apache HTTP Server 2.4.30 through 2.4.68 configured as a reverse proxy to a uwsgi backend via mod_proxy_uwsgi; installations that do not load or use mod_proxy_uwsgi are not affected. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) is network-reachable by unauthenticated remote attackers, but exploitation is gated by high complexity because the attacker must control or influence the backend uwsgi response - typically through a malicious or compromised backend application, or a response-header-injection flaw in it - so this is not reachable against a default Apache install. No public exploit code has been identified and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is limited to low confidentiality and low integrity with a scope change, not full remote code execution or denial of service.
Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthenticated client to crash the server or potentially execute arbitrary code by sending an HTTP request whose Host header exceeds 8192 bytes. The flaw is not reachable in default deployments: the operator must have configured VirtualDocumentRoot (or VirtualScriptAlias) with a hostname format specifier such as %0 or %1 and must have raised LimitRequestFieldSize above its 8192-byte default, a non-default and uncommon combination that is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No KEV listing, EPSS score, or public exploit code was available at time of analysis, so there is no public exploit identified at time of analysis; the dominant uncertainty is the absence of any quantitative exploitation signal, while the real-world exploitability is sharply constrained by the required operator-set configuration. Users are advised to upgrade to 2.4.69, which fixes the issue.
Forward proxy deployments of Apache HTTP Server through 2.4.68 that relay FTP traffic can be manipulated by an untrusted FTP server into opening a data connection to an arbitrary third-party host, because mod_proxy_ftp fails to validate the address returned in an FTP PASV reply. Only non-default configurations with forward proxying enabled (ProxyRequests On) and mod_proxy_ftp loaded are affected, and the primary impact is a misdirected outbound data connection rather than compromise of the proxy host itself. No KEV entry, EPSS score, or POC was supplied and no public exploit has been identified at time of analysis, so prioritization signals are limited and authentication requirements are not confirmed from the supplied data.
Improper privilege management in Apache HTTP Server's mod_ssl (versions 2.4.0 through 2.4.68) causes SSLRequire access-control directives that use file-related expressions to be evaluated in a way that can grant or deny access contrary to the server operator's intent, giving a remote attacker a possible means to reach content that the SSLRequire check was meant to protect or, conversely, to disrupt intended authorization. The flaw is not reachable in a default configuration: exploitation requires mod_ssl to be loaded and the operator to have configured access control specifically through the SSLRequire directive using file-related expressions, a non-default, operator-chosen configuration, which is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (high attack complexity, low confidentiality and integrity impact, no availability impact); authentication requirements for the attacker are not confirmed from available data. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided.
An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processes request paths containing MS-DOS 8.3 short filenames that expand to longer names, giving a remote attacker a route to service disruption (assessed availability impact High) with limited confidentiality and integrity impact. Exploitation is Windows-only and conditional: 8.3 short-name generation must be enabled on the underlying NTFS volume (the historical default unless NtfsDisable8dot3NameCreation has been set) and the crafted path must actually reach the expanding-path code path, which is reflected in the assessed vector's AC:H. Apache published no CVSS score, and the supplied intelligence contains no CISA KEV listing, no public exploit code, and no EPSS probability, so there is no public exploit identified at time of analysis.
Use-after-free in Apache HTTP Server's mod_http2 module (versions 2.4.0 through 2.4.68) allows unauthenticated remote attackers to corrupt memory and crash server worker processes by driving re-entrant access to a shared per-session buffer. The flaw only manifests when mod_http2 is loaded and HTTP/2 is actually enabled (h2 and/or h2c in the Protocols directive), and the trigger requires specific concurrent/streamed HTTP/2 request patterns, so the assessed vector is network-reachable but high complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact limited to availability. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied.
An out-of-bounds write in Apache HTTP Server's mod_proxy_html output filter affects versions 2.4.0 through 2.4.68 and can be triggered by a crafted HTML response body that the server parses and rewrites while proxying upstream content. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates remote unauthenticated attackers can reach the flaw, but high attack complexity reflects a significant deployment prerequisite: mod_proxy_html must be explicitly loaded and actively rewriting proxied HTML, which is not a default configuration, and the attacker must be able to influence the upstream/backend response body being processed. The result is memory corruption with low confidentiality and integrity impact and a high availability impact, and no public exploit has been identified at the time of analysis; servers used solely as origin web servers, or proxies that do not enable mod_proxy_html, are not affected.
Denial of service in Apache HTTP Server 2.4.0 through 2.4.68 arises from a use-after-free in the mod_rewrite module that is reachable only when a RewriteRule or RewriteCond uses the lookahead variables %{LA-U:...} or %{LA-F:...}, which exercise an internal subrequest code path. An unauthenticated remote attacker who can reach a server configured that way can trigger the memory error and crash request-handling processes, degrading or halting service; the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is confined to availability and the high attack complexity combined with the non-default configuration prerequisite substantially limits real-world exploitability. No CVSS score or vector has been published by NVD or the vendor, there is no EPSS probability and no CISA KEV listing, and no public exploit code has been identified at time of analysis.
An out-of-bounds write in Apache HTTP Server's optional mod_charset_lite module (affecting versions 2.4.0 through 2.4.68) can corrupt process memory when character-set translation is configured, potentially crashing the server or enabling limited data disclosure or modification. Exposure is narrow: mod_charset_lite is not loaded in default installations and must be explicitly enabled and bound to a content path via directives such as CharsetSourceEnc, CharsetDefault, or an associated input/output filter, which is why the assessed vector rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Independent signals are otherwise sparse - no public exploit code, no CISA KEV listing, and no EPSS score were available - so no public exploit identified at time of analysis, and the practical severity hinges on whether the module is deployed.
Apache HTTP Server before 2.4.69 can be forced into repeated re-authentication by unauthenticated remote attackers sending forged Authorization headers when Digest authentication is enabled with the non-default AuthDigestNcCheck directive. Successful exploitation causes a limited availability impact, denial of service through forced re-authentication, without compromising data confidentiality or integrity. No public exploit code was identified at time of analysis, and the flaw is constrained to the uncommon Digest-auth-plus-AuthDigestNcCheck configuration.
Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to trigger memory corruption when the server's file handle pool is exhausted. The flaw carries a CVSS 7.3 (low impact across confidentiality, integrity, and availability) and is reachable over the network without authentication or user interaction, though no public exploit identified at time of analysis. Tagging emphasizes denial-of-service and memory corruption as the primary realistic outcomes.
Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server by submitting untrusted XML content processed by the mod_xml2enc module's xml2StartParse function. The flaw is a CWE-122 heap-based buffer overflow with a CVSS 7.5 score reflecting high availability impact only, and no public exploit has been identified at time of analysis.
Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limited integrity and availability impact via outbound OCSP requests sent to an attacker-controlled OCSP responder. The flaw stems from improper bounds handling (CWE-126) when parsing OCSP response data, and currently shows no public exploit identified at time of analysis despite a CVSS 7.3 rating reflecting unauthenticated network reachability with low complexity.
Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html output filter, where a malicious or compromised backend can return crafted HTML that corrupts memory in the proxying httpd worker. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated network exploitation with availability-only impact, and no public exploit was identified at time of analysis.
Apache HTTP Server 2.4.0-2.4.67 has a buffer underwrite (CWE-124) in ap_regname, triggered by a crafted regular expression in the server configuration. The vendor (Apache) rates this Low severity. A separate CISA-ADP assessment assigned CVSS 9.8 using a network, unauthenticated vector that is inconsistent with the vendor description, because exploitation requires control over the httpd configuration. No public exploit and not in CISA KEV. Fixed in 2.4.68.
Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author to directly manipulate trusted DAV property databases, leading to integrity violations and child process crashes. With a CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N) and SSVC technical impact rated 'total' with automatable=yes, the flaw is highly impactful, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered when the server processes responses from a malicious backend while ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath directives are in use. Remote attackers controlling or compromising an upstream backend can crash the front-end Apache process, impacting availability of the reverse proxy without affecting confidentiality or integrity. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from an infinite loop condition in the mod_proxy_ftp module when interacting with an attacker-controlled backend FTP server. Remote attackers can degrade availability and partially impact confidentiality and integrity without authentication, though exploitation requires a proxied request path to a malicious FTP backend. No public exploit identified at time of analysis, and EPSS is very low at 0.02%.
Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition in mod_ldap when LDAP authentication or authorization is configured in a per-directory context. The CVSS 9.8 rating reflects unauthenticated network exploitation with high impact across confidentiality, integrity, and availability, though no public exploit has been identified at time of analysis and EPSS exploitation probability remains very low at 0.02%. CISA SSVC assesses exploitation status as none but flags the issue as automatable with total technical impact.
Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying to attacker-controlled AJP backends. Affects all versions through 2.4.66; attackers can achieve remote code execution by sending malicious AJP protocol responses that overflow a heap buffer with 4 controlled bytes. Apache released patch in version 2.4.67. Despite critical CVSS 9.8, EPSS probability remains very low (0.02%, 5th percentile) indicating minimal observed exploitation attempts, and no CISA KEV listing confirms active in-the-wild abuse. Exploitation requires specific proxy_ajp deployment configuration connecting to malicious AJP servers.
Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhaust server resources via malformed OCSP response data, affecting versions 2.4.30 through 2.4.66. The vulnerability enables attackers to achieve confidentiality, integrity, and availability impacts with low complexity exploitation over the network. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack surface and lack of authentication requirement make this a credible threat requiring prompt patching to version 2.4.67.
Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL pointer dereference in mod_dav_lock, causing denial of service. The vulnerability affects only servers with mod_dav_lock enabled, a legacy module whose primary use-case (Apache Subversion < 1.2.0) is obsolete in modern deployments. CISA SSVC indicates no active exploitation, but the attack is automatable against susceptible configurations. CVSS 7.5 (High) reflects network-accessible, unauthenticated denial of service, though real-world impact is limited to the small subset of servers still running mod_dav_lock.
Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation allows authenticated attackers to compromise server integrity and confidentiality with high impact. Vendor-released patch 2.4.67 addresses the issue. No public exploit or active exploitation confirmed at time of analysis, but SSVC framework rates technical impact as total, indicating complete system compromise potential.
Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network scale. Attackers can read sensitive memory content without authentication or user interaction, achieving high confidentiality impact with low attack complexity. EPSS exploitation probability and KEV status not provided, but SSVC framework confirms the vulnerability is automatable with partial technical impact and no active exploitation detected at time of analysis. Patch released in version 2.4.67.
Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2.4.66 and earlier. The vulnerability requires low-privilege authenticated access to create or modify .htaccess files, but exploits misconfigured module interactions to bypass intended access controls. Apache has released version 2.4.67 to address this issue. SSVC assessment indicates no active exploitation and non-automatable attack vector, with EPSS data not yet available for this recent disclosure.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 arises from a path-equivalence flaw (CWE-55, '/./' single-dot directory) in the mod_userdir module, which mishandles the single-dot directory segment when the UserDir directive is configured with an absolute, non-wildcard path. Only deployments that load mod_userdir and use that specific second syntax form (for example 'UserDir /some/absolute/path') are exposed; servers on the default wildcard/username form, or without mod_userdir loaded, are unaffected regardless of version, so the practical exposure surface is a non-default configuration. The issue is network-reachable over HTTP and is assessed as low-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code or confirmed active exploitation has been identified at time of analysis, and no patch version is specified in the available advisory data.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 allows an unauthenticated remote client to read WebDAV dead properties of resources it cannot author by sending an HTTP GET request to the module's internal .DAV state directory. The flaw is in mod_dav_fs (CWE-552, files or directories accessible to external parties) and is reachable only when mod_dav and mod_dav_fs are loaded with WebDAV enabled and the .DAV state directory is web-accessible, so no default configuration is affected. No public exploit identified at time of analysis, and there is no CISA KEV listing; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a read-only, low-confidentiality leak of client-set metadata with no integrity, availability, or code-execution impact.
Privilege escalation in Apache HTTP Server 2.4.0 through 2.4.67 allows local users with .htaccess write access to read arbitrary files using the privileges of the httpd daemon process, exploiting improper privilege management (CWE-269). The attack vector is local, requires low privileges, and impacts only confidentiality - no integrity or availability impact is present. No public exploit code and no active exploitation have been identified; SSVC classifies technical impact as partial and the vulnerability as non-automatable, consistent with the targeted, local nature of the attack.
Out-of-bounds read in Apache HTTP Server 2.4.0 through 2.4.67 arises from an interaction between mod_headers, mod_mime, and multi-language content negotiation, allowing unauthenticated remote attackers to trigger memory reads beyond allocated buffer boundaries. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) confirms low-complexity, unauthenticated network exploitation yielding limited confidentiality and integrity impact with no availability consequence. No active exploitation confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-site scripting in Apache HTTP Server's mod_proxy_ftp module allows a network-accessible attacker to inject malicious scripts into HTML directory listings generated when the server proxies FTP directory contents. Affected are all versions of Apache HTTP Server up to and including 2.4.67, in both forward and reverse proxy configurations. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the Changed scope (S:C) in the CVSS vector means injected scripts execute in victims' browsers under the origin of the proxy host, elevating the effective impact beyond the medium base score.
Timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows remote unauthenticated attackers to bypass Digest authentication with high attack complexity. The vulnerability exploits measurable timing differences in digest credential validation, enabling credential compromise without valid authentication. Apache has released patched version 2.4.67; no active exploitation has been confirmed, but CISA SSVC framework indicates automatable exploitation is not feasible due to the timing attack's sensitivity requirements.
Null pointer dereference in mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows unauthenticated remote attackers to crash child processes in caching forward proxy configurations, resulting in denial of service. The vulnerability has CVSS 5.3 (medium) with network accessibility and no authentication required, but is limited to partial availability impact affecting only specific proxy deployments. Vendor-released patch: version 2.4.67.
HTTP response splitting in Apache HTTP Server 2.4.0 through 2.4.66 allows remote attackers to inject arbitrary HTTP headers and content when the server acts as a proxy to untrusted or compromised backend servers, enabling cache poisoning, session fixation, and cross-site scripting attacks. CVSS 6.5 (moderate) with network attack vector, no authentication required, and confirmed automatable exploitation per CISA SSVC framework. Vendor-released patch: version 2.4.67.
Out-of-bounds read in mod_proxy_ajp of Apache HTTP Server through version 2.4.66 allows remote unauthenticated attackers to disclose sensitive information via a crafted AJP protocol request. The vulnerability has a CVSS score of 5.3 (moderate) with no active exploitation confirmed. Upgrade to version 2.4.67 to remediate.
Improper null termination and out-of-bounds read vulnerability in Apache HTTP Server through version 2.4.66 allows remote unauthenticated attackers to trigger information disclosure with low complexity exploitation. The vulnerability has a CVSS score of 5.3 (medium) with network-accessible attack vector and no user interaction required, though technical impact is limited to confidentiality (partial information disclosure). Vendor-released patch: version 2.4.67 addresses the issue.