GCVE - cpe:2.3:a:apache:http_server:2.4.19:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:http_server:2.4.19:*:*:*:*:*:*:*

part: a version: 2.4.19 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Http Server (`294238f2-8bb7-5c9e-8927-fa193467c02f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/httpd`	purl2cpe	2026-06-01 10:14:24.096121
`pkg:docker/apache/httpd`	purl2cpe	2026-06-01 10:14:24.096123
`pkg:github/apache/httpd`	purl2cpe	2026-06-01 10:14:24.096125
`pkg:rpm/fedora/httpd`	purl2cpe	2026-06-01 10:14:24.096126

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-8740`	vulnerable	2026-06-08 05:08:14.757545	Details available The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request. Published: 2016-12-05T19:00:00.000Z Updated: 2024-08-06T02:34:59.624Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3 http://www.securitytracker.com/id/1037388 http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-4979`	vulnerable	2026-06-08 05:07:55.864641	Details available The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation. Published: 2016-07-06T14:00:00.000Z Updated: 2024-08-06T00:46:39.899Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2016:1420 http://httpd.apache.org/security/vulnerabilities_24.html https://security.gentoo.org/glsa/201610-02 http://seclists.org/fulldisclosure/2016/Jul/11 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2161`	vulnerable	2026-06-08 05:07:33.432591	Details available In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests. Published: 2017-07-27T21:00:00.000Z Updated: 2024-09-16T22:02:00.808Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 http://www.securityfocus.com/bid/95076 http://www.debian.org/security/2017/dsa-3796 http://www.securitytracker.com/id/1037508 https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-0736`	vulnerable	2026-06-08 05:07:16.001494	Details available In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC. Published: 2017-07-27T21:00:00.000Z Updated: 2024-09-16T17:52:49.825Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 http://www.debian.org/security/2017/dsa-3796 https://www.exploit-db.com/exploits/40961/ http://www.securitytracker.com/id/1037508 https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.