GCVE - cpe:2.3:a:apache:http_server:2.4.22:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:http_server:2.4.22:*:*:*:*:*:*:*

part: a version: 2.4.22 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Http Server (`294238f2-8bb7-5c9e-8927-fa193467c02f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/httpd`	purl2cpe	2026-06-01 10:14:24.096149
`pkg:docker/apache/httpd`	purl2cpe	2026-06-01 10:14:24.096155
`pkg:github/apache/httpd`	purl2cpe	2026-06-01 10:14:24.096157
`pkg:rpm/fedora/httpd`	purl2cpe	2026-06-01 10:14:24.096159

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-8740`	vulnerable	2026-06-08 05:08:14.759091	Details available The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request. Published: 2016-12-05T19:00:00.000Z Updated: 2024-08-06T02:34:59.624Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3 http://www.securitytracker.com/id/1037388 http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2161`	vulnerable	2026-06-08 05:07:33.434049	Details available In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests. Published: 2017-07-27T21:00:00.000Z Updated: 2024-09-16T22:02:00.808Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 http://www.securityfocus.com/bid/95076 http://www.debian.org/security/2017/dsa-3796 http://www.securitytracker.com/id/1037508 https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-0736`	vulnerable	2026-06-08 05:07:16.003418	Details available In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC. Published: 2017-07-27T21:00:00.000Z Updated: 2024-09-16T17:52:49.825Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 http://www.debian.org/security/2017/dsa-3796 https://www.exploit-db.com/exploits/40961/ http://www.securitytracker.com/id/1037508 https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.