Technology · Apache
Apache HTTP Server vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 62 vulnerabilities in Apache HTTP Server: 3 in the last 7 days and 20 in the last 90 days, 11 of them critical and 6 exploited in the wild. The most recent, CVE-2026-119618, was published on 11 November 2026. Nothing in the last four weeks, down from 17 vulnerabilities in the four before. 0 critical against 3.
- Last 7 days
- 3
- Last 90 days
- 20
- Critical, all time
- 11
- Exploited in the wild
- 6
About Apache HTTP Server
A general-purpose web server software that handles HTTP requests and serves web content.
Latest Apache HTTP Server vulnerabilities
- CVE-2026-119618: Apache HTTP Server mod_http2 heap corruption in assign_headersinfo
- CVE-2026-109163: Apache HTTP Server mod_vhost_alias stack buffer overflowinfo
- CVE-2026-106023: Apache HTTP Server mod_md NULL pointer dereferenceinfo
- CVE-2026-93546: Apache HTTP Server mod_dav_fs integer overflow in namespace handlinghighCVSS 8.8EPSS 0.3%
- CVE-2026-79768: Apache HTTP Server mod_userdir path equivalence in single-dot directorymediumCVSS 5.3EPSS 0.3%
- CVE-2026-63718: Apache HTTP Server response smuggling in mod_proxy_uwsgihighCVSS 7.5EPSS 0.3%
- CVE-2026-63045: Apache HTTP Server FTP PASV reply validation bypass in mod_proxy_ftphighCVSS 7.5EPSS 0.3%
- CVE-2026-59797: Apache HTTP Server mod_ssl privilege escalation in SSLRequire expressionscriticalCVSS 9.8EPSS 0.4%
- CVE-2026-59685: Apache HTTP Server out-of-bounds write in path canonicalization on WindowshighCVSS 7.5EPSS 0.4%
- CVE-2026-58415: Apache HTTP Server mod_dav_fs information disclosure in WebDAV propertiesmediumCVSS 5.3EPSS 0.3%
- CVE-2026-57941: Apache HTTP Server mod_http2 use-after-free via shared session bbtmpcriticalCVSS 9.8EPSS 0.4%
- CVE-2026-56449: Apache HTTP Server mod_proxy_html out-of-bounds writehighCVSS 7.5EPSS 0.4%
- CVE-2026-56154: Apache HTTP Server mod_rewrite use-after-free via lookaheadcriticalCVSS 9.8EPSS 0.4%
- CVE-2026-56153: Apache HTTP Server heap overflow in mod_charset_litehighCVSS 7.5EPSS 0.5%
- CVE-2026-48005: Apache HTTP Server mod_auth_digest reauthentication attackhighCVSS 7.5EPSS 0.6%
- CVE-2026-47360: Apache HTTP Server session cookie exposure in mod_session_cookiehighCVSS 7.5EPSS 0.4%
- CVE-2026-46729: Apache HTTP Server mod_heartmonitor null pointer dereferencehighCVSS 7.5EPSS 0.5%
- CVE-2026-42528: Apache httpd mod_dav memory calculation bugmediumCVSS 4.3EPSS 0.4%
- CVE-2026-42356: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI…lowCVSS 3.7EPSS 0.5%
- CVE-2026-89281: Apache HTTP Server hardcoded openssl.cnf path vulnerability on WindowshighCVSS 8.4EPSS 0.1%
- CVE-2026-49975: Apache HTTP Server denial of service in mod_httpinfoCVSS 0
- CVE-2026-48913: Apache HTTP Server use after free in mod_http2info
- CVE-2026-44631: Apache HTTP Server buffer underwrite in ap_regname via configurationinfo
- CVE-2026-44186: Apache HTTP Server infinite loop in mod_proxy_ftpinfo
- CVE-2026-44185: Apache HTTP Server buffer over-read in mod_ssl OCSP send_requestinfoCVSS 0
Most severe Apache HTTP Server vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerabilitycriticalexploited in the wildCVSS 9.1
- CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)criticalexploited in the wildCVSS 9
- CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerabilitycriticalexploited in the wildCVSS 7.8
- CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attackcriticalexploited in the wildCVSS 5.3EPSS 100.0%
- CVE-1999-0067: NCSA/Apache phf CGI program OS command injectioncriticalCVSS 10
- CVE-2026-28780: Apache HTTP Server heap overflow in mod_proxy_ajpcriticalCVSS 9.8EPSS 0.7%
- CVE-2026-57941: Apache HTTP Server mod_http2 use-after-free via shared session bbtmpcriticalCVSS 9.8EPSS 0.4%
- CVE-2026-56154: Apache HTTP Server mod_rewrite use-after-free via lookaheadcriticalCVSS 9.8EPSS 0.4%
Vulnerabilities per week
Nothing in the last four weeks, down from 17 vulnerabilities in the four before. 0 critical against 3. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 16 | 3 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 3 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache HTTP Server vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/http-server)<a href="https://junglewise.ai/threats/technologies/http-server"><img src="https://junglewise.ai/threats/technologies/http-server/badge.svg" alt="Apache HTTP Server vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/http-server.json, and this page as text at https://junglewise.ai/threats/technologies/http-server.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache HTTP Server vulnerabilities", https://junglewise.ai/threats/technologies/http-server, 12 November 2026.