Apache Software Foundation Apache HTTP Server vulnerabilities

CVEs per yearBy the year they were published

1. 20161
2. 201711
3. 201811
4. 20196
5. 202118
6. 202212
7. 20238
8. 202414
9. 202514
10. 202644

Known exploitedNewest addition to KEV first

• CVE-2024-38475

  Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

  Apache Software Foundation · Apache HTTP Server

  ExploitedCritical9.1
• CVE-2021-40438

  mod_proxy SSRF

  Apache Software Foundation · Apache HTTP Server

  ExploitedCritical9.0
• CVE-2021-42013

  Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

  Apache Software Foundation · Apache HTTP Server

  ExploitedCritical9.8
• CVE-2021-41773

  Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

  Apache Software Foundation · Apache HTTP Server

  ExploitedHigh7.5

Newest CVEs

• CVE-2026-63686

  Apache HTTP Server: mod_xml2enc crash on charset conversion failure

  Apache Software Foundation · Apache HTTP Server

  High7.5
• CVE-2026-93546

  Apache HTTP Server: mod_dav_fs namespace overflow

  Apache Software Foundation · Apache HTTP Server

  High8.8
• CVE-2026-79768

  Apache HTTP Server: mod_userdir information disclosure

  Apache Software Foundation · Apache HTTP Server

  Medium5.3
• CVE-2026-73637

  Apache HTTP Server: mod_auth_digest DoS attack

  Apache Software Foundation · Apache HTTP Server

  High7.3
• CVE-2026-73636

  Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

  Apache Software Foundation · Apache HTTP Server

  High8.1
• CVE-2026-63718

  Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

  Apache Software Foundation · Apache HTTP Server

  High7.5
• CVE-2026-63292

  Apache HTTP Server: mod_vhost_alias stack overflow

  Apache Software Foundation · Apache HTTP Server

  High7.5
• CVE-2026-63045

  Apache HTTP Server: mod_proxy_ftp PASV address handling

  Apache Software Foundation · Apache HTTP Server

  High7.5
• CVE-2026-59797

  Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

  Apache Software Foundation · Apache HTTP Server

  Critical9.8
• CVE-2026-59685

  Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

  Apache Software Foundation · Apache HTTP Server

  High7.5