Apache Software Foundation Apache HTTP Server
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Http Server (294238f2-8bb7-5c9e-8927-fa193467c02f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/httpd |
purl2cpe | 2026-06-01 10:14:23.885856 |
pkg:docker/apache/httpd |
purl2cpe | 2026-06-01 10:14:23.885857 |
pkg:github/apache/httpd |
purl2cpe | 2026-06-01 10:14:23.885859 |
pkg:rpm/fedora/httpd |
purl2cpe | 2026-06-01 10:14:23.885861 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-3891 |
vulnerable | 2026-06-08 07:23:10.101382 |
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
HIGH (7.5)
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Published: 2025-04-29T11:56:50.808Z
Updated: 2026-06-29T20:42:40.007Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39573 |
vulnerable | 2026-06-08 06:41:51.079802 |
Apache HTTP Server: mod_rewrite proxy handler substitution
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published: 2024-07-01T18:16:44.297Z
Updated: 2025-11-03T21:56:32.361Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-0425 |
vulnerable | 2026-06-08 04:52:02.439364 |
Details available
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
Published: 2010-03-05T19:00:00.000Z
Updated: 2024-08-07T00:45:12.325Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-2384 |
not_vulnerable | 2026-06-08 04:50:23.853794 |
Details available
SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
Published: 2009-01-22T18:00:00.000Z
Updated: 2024-08-07T08:58:02.299Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-2168 |
vulnerable | 2026-06-08 04:50:23.111453 |
Details available
Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
Published: 2008-05-13T21:00:00.000Z
Updated: 2024-08-07T08:49:58.493Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-6423 |
vulnerable | 2026-06-08 04:50:08.787355 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-6422 |
vulnerable | 2026-06-08 04:50:08.786873 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-6421 |
vulnerable | 2026-06-08 04:50:08.784755 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-0450 |
vulnerable | 2026-06-08 04:49:32.218251 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-0086 |
vulnerable | 2026-06-08 04:49:31.422905 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-1999-1412 |
vulnerable | 2026-06-08 04:44:58.304389 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-1999-1237 |
vulnerable | 2026-06-08 04:44:58.243943 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-1999-0678 |
vulnerable | 2026-06-08 04:44:58.082650 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-1999-0289 |
vulnerable | 2026-06-08 04:44:57.995852 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-1999-0236 |
vulnerable | 2026-06-08 04:44:57.978731 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.