Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Advisory: Apache HTTP Server — GLSA-202107-38 Clear all filters
TI-2021-11716 CVE-2021-31618 · GHSA-4jq3-qrx6-87cc

NULL pointer dereference on specially crafted HTTP/2 request

Priority HIGH 71

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.52142 Published 2021-06-15 No fix listed CWE-476
TI-2021-11032 CVE-2021-30641 · GHSA-jfgv-4796-2jw7

Unexpected URL matching with 'MergeSlashes OFF'

Priority MEDIUM 56

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.51765 Published 2021-06-10 Partial fix
TI-2021-08375 CVE-2021-26691 · GHSA-j3ww-p97m-gh9x

Apache HTTP Server mod_session response handling heap overflow

Priority HIGH 79

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68067 Published 2021-06-10 Partial fix CWE-122
TI-2021-08374 CVE-2021-26690 · GHSA-f669-j28w-pjvg

mod_session NULL pointer dereference

Priority HIGH 69

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.65067 Published 2021-06-10 Partial fix CWE-476
TI-2020-17981 CVE-2020-35452 · GHSA-77mj-xh9q-fm9j

mod_auth_digest possible stack overflow by one nul byte

Priority MEDIUM 64

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.53191 Published 2021-06-10 Partial fix CWE-787
TI-2020-10926 CVE-2020-13950 · GHSA-pqc6-p826-c5qw

mod_proxy_http NULL pointer dereference

Priority MEDIUM 64

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.50023 Published 2021-06-10 Partial fix CWE-476
TI-2019-13110 CVE-2019-17567 · GHSA-qf63-wqjv-7x2f

mod_proxy_wstunnel tunneling of non Upgraded connections

Priority MEDIUM 58

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent reques…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.59732 Published 2021-06-10 Partial fix CWE-444