Software Watch

Apache HTTP Server の脆弱性情報

配布元の告知ページ　2024-04-04 以降を収録

告知公開日重大度CVE
mod_dav_fs namespace overflow ほか 19 件
  • mod_dav_fs namespace overflow CVE-2026-93546 moderate
  • mod_userdir information disclosure CVE-2026-79768 low
  • mod_auth_digest DoS attack CVE-2026-73637 low
  • mod_auth_digest one-time-nonce replay attack CVE-2026-73636 low
  • mod_proxy_uwsgi Transfer-Encoding response smuggling CVE-2026-63718 low
  • mod_xml2enc crash on charset conversion failure CVE-2026-63686 low
  • mod_vhost_alias stack overflow CVE-2026-63292 moderate
  • mod_proxy_ftp PASV address handling CVE-2026-63045 low
  • mod_ssl SSLRequire allows .htaccess ap_expr file-function CVE-2026-59797 low
  • Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM CVE-2026-59685 moderate
  • mod_dav_fs property database read access CVE-2026-58415 low
  • Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy CVE-2026-57941 moderate
  • mod_proxy_html: crash in dump_content CVE-2026-56449 low
  • mod_rewrite use-after-free via %{LA-U:HTTP:...} CVE-2026-56154 low
  • mod_charset_lite: Heap overflow in finish_partial_char CVE-2026-56153 low
  • mod_auth_digest reauthentication attack CVE-2026-48005 low
  • mod_session: Session cookie not removed during internal redirect CVE-2026-47360 low
  • mod_heartmonitor denial of service CVE-2026-46729 low
  • mod_dav shared lock overflow CVE-2026-42528 moderate
  • limited RCE for some internal redirects to non-CGI files in CGI directories CVE-2026-42356 low

AI Apache HTTP Server 2.4.xの複数のモジュールに脆弱性が存在する。バッファオーバーフロー、use-after-free、サービス妨害、情報漏洩など様々な脆弱性が報告されており、2.4.69への更新で修正される。

修正版 2.4.69

固定リンク		2026-10-01moderate, lowCVE-2026-93546, CVE-2026-79768, CVE-2026-73637 ほか 17 件
mod_http2 denial of service ほか 12 件
  • mod_http2 denial of service CVE-2026-49975 moderate
  • mod_http2 memory corruption when file handles exhausted CVE-2026-48913 low
  • Heap Underflow in `ap_regname` via Signed Char Overflow CVE-2026-44631 low
  • Loop in `proxy_ftp_handler` in mod_proxy_ftp CVE-2026-44186 moderate
  • Stack Buffer Over-Read in mod_ssl OCSP `send_request` CVE-2026-44185 low
  • escalation of privilege through expressions in .htaccess in multiple modules CVE-2026-44119 moderate
  • OOB Read in `merge_response_headers` can cause crash CVE-2026-43951 moderate
  • mod_xml2enc heap overflow CVE-2026-42536 low
  • mod_dav_fs protected directory access CVE-2026-42535 moderate
  • ProxyPassReverseCookieMap buffer overflow CVE-2026-34356 low
  • mod_proxy_html buffer overflow CVE-2026-34355 moderate
  • mod_proxy_ftp XSS CVE-2026-29170 low
  • mod_ldap per-dir use-after-free CVE-2026-29167 low
固定リンク		2026-06-08moderate, lowCVE-2026-49975, CVE-2026-48913, CVE-2026-44631 ほか 10 件
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() ほか 10 件
  • Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() CVE-2026-34059 low
  • mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) CVE-2026-34032 low
  • Apache HTTP Server: Off-by-one OOB reads in AJP getter functions CVE-2026-33857 low
  • multiple modules: HTTP response splitting forwarding malicious status line CVE-2026-33523 low
  • mod_authn_socache crash CVE-2026-33007 low
  • mod_auth_digest timing attack CVE-2026-33006 moderate
  • mod_dav_lock indirect lock crash CVE-2026-29169 low
  • Apache HTTP Server: mod_md unrestricted OCSP response CVE-2026-29168 low
  • Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() CVE-2026-28780 low
  • Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr CVE-2026-24072 moderate
  • Apache HTTP Server: http2: double free and possible RCE on early reset CVE-2026-23918 important
固定リンク		2026-05-04low, moderate, importantCVE-2026-34059, CVE-2026-34032, CVE-2026-33857 ほか 8 件
Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo ほか 4 件
  • Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo CVE-2025-66200 moderate
  • Apache HTTP Server: CGI environment variable override CVE-2025-65082 low
  • Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF CVE-2025-59775 moderate
  • Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... CVE-2025-58098 moderate
  • Apache HTTP Server: mod_md (ACME), unintended retry intervals CVE-2025-55753 low
固定リンク		2025-12-04moderate, lowCVE-2025-66200, CVE-2025-65082, CVE-2025-59775 ほか 2 件
Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64 CVE-2025-54090 固定リンク2025-07-23moderateCVE-2025-54090
Apache HTTP Server: HTTP/2 DoS by Memory Increase ほか 7 件
  • Apache HTTP Server: HTTP/2 DoS by Memory Increase CVE-2025-53020 moderate
  • Apache HTTP Server: mod_ssl TLS upgrade attack CVE-2025-49812 moderate
  • Apache HTTP Server: mod_proxy_http2 denial of service CVE-2025-49630 low
  • Apache HTTP Server: mod_ssl access control bypass with session resumption CVE-2025-23048 moderate
  • Apache HTTP Server: mod_ssl error log variable escaping CVE-2024-47252 low
  • Apache HTTP Server: SSRF on Windows due to UNC paths CVE-2024-43394 moderate
  • Apache HTTP Server: SSRF with mod_headers setting Content-Type header CVE-2024-43204 low
  • Apache HTTP Server: HTTP response splitting CVE-2024-42516 moderate
固定リンク		2025-07-10moderate, lowCVE-2025-53020, CVE-2025-49812, CVE-2025-49630 ほか 6 件
Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows ほか 1 件
  • Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows CVE-2024-40898 important
  • Apache HTTP Server: source code disclosure with handlers configured via AddType CVE-2024-40725 important
固定リンク		2024-07-17importantCVE-2024-40898, CVE-2024-40725, CVE-2024-39884
Apache HTTP Server: source code disclosure with handlers configured via AddType CVE-2024-39884 固定リンク2024-07-03importantCVE-2024-39884
Apache HTTP Server: mod_rewrite proxy handler substitution ほか 7 件
  • Apache HTTP Server: mod_rewrite proxy handler substitution CVE-2024-39573 moderate
  • Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request CVE-2024-38477 important
  • Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect CVE-2024-38476 important
  • Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. CVE-2024-38475 important
  • Apache HTTP Server weakness with encoded question marks in backreferences CVE-2024-38474 important
  • Apache HTTP Server proxy encoding problem CVE-2024-38473 moderate
  • Apache HTTP Server on WIndows UNC SSRF CVE-2024-38472 important
  • Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 CVE-2024-36387 low
固定リンク		2024-07-01moderate, important, lowCVE-2024-39573, CVE-2024-38477, CVE-2024-38476 ほか 5 件
Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames ほか 2 件
  • Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames CVE-2024-27316 moderate
  • Apache HTTP Server: HTTP Response Splitting in multiple modules CVE-2024-24795 low
  • Apache HTTP Server: HTTP response splitting CVE-2023-38709 moderate

AI HTTPレスポンス分割（入力検証不備とバックエンド注入）およびHTTP/2メモリ枯渇型DoSの脆弱性が修正された。2.4.59への更新が必要。

修正版 2.4.59

固定リンク		2024-04-04moderate, lowCVE-2024-27316, CVE-2024-24795, CVE-2023-38709

72 件。配布元が出した告知をそのまま並べたもので、製品の版とはまだ結び付けていません。

こちらで見つけた日

このサイトが更新に気づいた日です。実際に公開された日は、これより前のことがあります。

まだ来ていない日付

配布元が将来の日付で公開しています。予定として書かれていることも、時差の都合でそう見えることもあります。