Apache Software Foundation HTTP Server 2.4.37
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:http_server:2.4.37:*:*:*:*:*:*:*
part: a version: 2.4.37 update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Http Server (294238f2-8bb7-5c9e-8927-fa193467c02f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/httpd |
purl2cpe | 2026-06-01 10:14:24.096269 |
pkg:docker/apache/httpd |
purl2cpe | 2026-06-01 10:14:24.096271 |
pkg:github/apache/httpd |
purl2cpe | 2026-06-01 10:14:24.096273 |
pkg:rpm/fedora/httpd |
purl2cpe | 2026-06-01 10:14:24.096275 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-10097 |
vulnerable | 2026-06-08 05:12:22.238836 |
Details available
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
Published: 2019-09-26T14:21:24.000Z
Updated: 2024-08-04T22:10:09.873Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-0215 |
vulnerable | 2026-06-08 05:12:19.337400 |
Details available
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.
Published: 2019-04-08T19:25:45.000Z
Updated: 2024-08-04T17:44:15.365Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-0190 |
vulnerable | 2026-06-08 05:12:19.204470 |
Details available
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.
Published: 2019-01-30T22:00:00.000Z
Updated: 2024-09-16T23:41:59.848Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-17189 |
vulnerable | 2026-06-08 05:11:06.119406 |
Details available
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
Published: 2019-01-30T22:00:00.000Z
Updated: 2024-09-17T01:21:57.609Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.