GCVE - cpe:2.3:a:apache:http_server:2.4.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:http_server:2.4.8:*:*:*:*:*:*:*

part: a version: 2.4.8 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Http Server (`294238f2-8bb7-5c9e-8927-fa193467c02f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/httpd`	purl2cpe	2026-06-01 10:14:24.096523
`pkg:docker/apache/httpd`	purl2cpe	2026-06-01 10:14:24.096525
`pkg:github/apache/httpd`	purl2cpe	2026-06-01 10:14:24.096527
`pkg:rpm/fedora/httpd`	purl2cpe	2026-06-01 10:14:24.096529

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2161`	vulnerable	2026-06-08 05:07:33.429449	Details available In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests. Published: 2017-07-27T21:00:00.000Z Updated: 2024-09-16T22:02:00.808Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 http://www.securityfocus.com/bid/95076 http://www.debian.org/security/2017/dsa-3796 http://www.securitytracker.com/id/1037508 https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-0736`	vulnerable	2026-06-08 05:07:15.998318	Details available In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC. Published: 2017-07-27T21:00:00.000Z Updated: 2024-09-16T17:52:49.825Z Open on db.gcve.eu Reference links https://support.apple.com/HT208221 http://www.debian.org/security/2017/dsa-3796 https://www.exploit-db.com/exploits/40961/ http://www.securitytracker.com/id/1037508 https://access.redhat.com/errata/RHSA-2017:1413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3185`	vulnerable	2026-06-08 05:06:37.456607	Details available The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. Published: 2015-07-20T23:00:00.000Z Updated: 2024-08-06T05:39:31.678Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html http://httpd.apache.org/security/vulnerabilities_24.html https://github.com/apache/httpd/commit/cd2b7a26c776b0754fb98426a67804fd48118708 http://rhn.redhat.com/errata/RHSA-2015-1667.html https://support.apple.com/HT205217	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3523`	vulnerable	2026-06-08 05:05:33.224978	Details available Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests. Published: 2014-07-20T10:00:00.000Z Updated: 2024-08-06T10:50:16.340Z Open on db.gcve.eu Reference links http://svn.apache.org/viewvc/httpd/httpd/trunk/server/mpm/winnt/child.c?r1=1608785&r2=1610652&diff_format=h http://marc.info/?l=bugtraq&m=144050155601375&w=2 http://httpd.apache.org/security/vulnerabilities_24.html http://marc.info/?l=bugtraq&m=143748090628601&w=2 http://svn.apache.org/viewvc/httpd/httpd/trunk/server/mpm/winnt/child.c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0117`	vulnerable	2026-06-08 05:05:11.594410	Details available The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header. Published: 2014-07-20T10:00:00.000Z Updated: 2024-08-06T09:05:38.974Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1120599 http://advisories.mageia.org/MGASA-2014-0305.html https://support.apple.com/HT204659 http://httpd.apache.org/security/vulnerabilities_24.html http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680&r2=1610674&diff_format=h	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.