# Apache HTTP Server vulnerabilities

Source: https://junglewise.ai/threats/technologies/http-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/http-server.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 62 vulnerabilities in Apache HTTP Server: 3 in the last 7 days and 20 in the last 90 days, 11 of them critical and 6 exploited in the wild. The most recent, CVE-2026-119618, was published on 11 November 2026. Nothing in the last four weeks, down from 17 vulnerabilities in the four before. 0 critical against 3.

## Counts

- Last 7 days: 3
- Last 30 days: 3
- Last 90 days: 20
- All time: 62 (11 critical, 6 exploited in the wild)

## About Apache HTTP Server

A general-purpose web server software that handles HTTP requests and serves web content.

## Latest Apache HTTP Server vulnerabilities

- [CVE-2026-119618: Apache HTTP Server mod_http2 heap corruption in assign_headers](https://junglewise.ai/threats/cve-2026-119618-concurrent-execution-using-shared-resource-with-improper) (info, published 11 Nov 2026)
- [CVE-2026-109163: Apache HTTP Server mod_vhost_alias stack buffer overflow](https://junglewise.ai/threats/cve-2026-109163-stack-based-buffer-overflow-vulnerability-in-apache-http-server) (info, published 11 Nov 2026)
- [CVE-2026-106023: Apache HTTP Server mod_md NULL pointer dereference](https://junglewise.ai/threats/cve-2026-106023-null-pointer-dereference-vulnerability-in-apache-http-server-s) (info, published 11 Nov 2026)
- [CVE-2026-93546: Apache HTTP Server mod_dav_fs integer overflow in namespace handling](https://junglewise.ai/threats/cve-2026-93546-integer-overflow-in-mod-dav-fs-in-apache-http-server-through-2-4) (high, CVSS 8.8, published 1 Oct 2026)
- [CVE-2026-79768: Apache HTTP Server mod_userdir path equivalence in single-dot directory](https://junglewise.ai/threats/cve-2026-79768-path-equivalence-single-dot-directory-vulnerability-in-apache) (medium, CVSS 5.3, published 1 Oct 2026)
- [CVE-2026-63718: Apache HTTP Server response smuggling in mod_proxy_uwsgi](https://junglewise.ai/threats/cve-2026-63718-inconsistent-interpretation-of-http-requests-http-request) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-63045: Apache HTTP Server FTP PASV reply validation bypass in mod_proxy_ftp](https://junglewise.ai/threats/cve-2026-63045-improper-validation-of-ftp-pasv-reply-address-in-mod-proxy-ftp-in) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-59797: Apache HTTP Server mod_ssl privilege escalation in SSLRequire expressions](https://junglewise.ai/threats/cve-2026-59797-improper-privilege-management-vulnerability-in-apache-http-server) (critical, CVSS 9.8, published 1 Oct 2026)
- [CVE-2026-59685: Apache HTTP Server out-of-bounds write in path canonicalization on Windows](https://junglewise.ai/threats/cve-2026-59685-out-of-bounds-write-vulnerability-in-apache-http-server-on) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-58415: Apache HTTP Server mod_dav_fs information disclosure in WebDAV properties](https://junglewise.ai/threats/cve-2026-58415-internal-state-files-accessible-to-external-parties-in-mod-dav-fs) (medium, CVSS 5.3, published 1 Oct 2026)
- [CVE-2026-57941: Apache HTTP Server mod_http2 use-after-free via shared session bbtmp](https://junglewise.ai/threats/cve-2026-57941-use-after-free-vulnerability-in-apache-http-server-s-mod-http2) (critical, CVSS 9.8, published 1 Oct 2026)
- [CVE-2026-56449: Apache HTTP Server mod_proxy_html out-of-bounds write](https://junglewise.ai/threats/cve-2026-56449-out-of-bounds-write-vulnerability-in-apache-http-server-s-mod) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-56154: Apache HTTP Server mod_rewrite use-after-free via lookahead](https://junglewise.ai/threats/cve-2026-56154-use-after-free-vulnerability-in-apache-http-server-s-mod-rewrite) (critical, CVSS 9.8, published 1 Oct 2026)
- [CVE-2026-56153: Apache HTTP Server heap overflow in mod_charset_lite](https://junglewise.ai/threats/cve-2026-56153-out-of-bounds-write-vulnerability-in-apache-http-server-s-mod) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-48005: Apache HTTP Server mod_auth_digest reauthentication attack](https://junglewise.ai/threats/cve-2026-48005-missing-authentication-checks-in-mod-auth-digest-in-apache) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-47360: Apache HTTP Server session cookie exposure in mod_session_cookie](https://junglewise.ai/threats/cve-2026-47360-exposure-of-sensitive-information-to-an-unauthorized-actor) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-46729: Apache HTTP Server mod_heartmonitor null pointer dereference](https://junglewise.ai/threats/cve-2026-46729-null-pointer-dereference-vulnerability-in-apache-http-servers-mod) (high, CVSS 7.5, published 1 Oct 2026)
- [CVE-2026-42528: Apache httpd mod_dav memory calculation bug](https://junglewise.ai/threats/cve-2026-42528-a-memory-calculation-bug-in-mod-dav-in-apache-httpd-2-4-67-and) (medium, CVSS 4.3, published 1 Oct 2026)
- [CVE-2026-42356: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI…](https://junglewise.ai/threats/cve-2026-42356-deployment-of-wrong-handler-vulnerability-in-apache-http-server) (low, CVSS 3.7, published 1 Oct 2026)
- [CVE-2026-89281: Apache HTTP Server hardcoded openssl.cnf path vulnerability on Windows](https://junglewise.ai/threats/cve-2026-89281-the-apache-lounge-windows-distribution-of-apache-http-server) (high, CVSS 8.4, published 22 Sep 2026)
- [CVE-2026-49975: Apache HTTP Server denial of service in mod_http](https://junglewise.ai/threats/cve-2026-49975-apache-http-server-denial-of-service-in-mod-http) (info, CVSS 0, published 8 Jun 2026)
- [CVE-2026-48913: Apache HTTP Server use after free in mod_http2](https://junglewise.ai/threats/cve-2026-48913-apache-http-server-use-after-free-in-mod-http2) (info, published 8 Jun 2026)
- [CVE-2026-44631: Apache HTTP Server buffer underwrite in ap_regname via configuration](https://junglewise.ai/threats/cve-2026-44631-apache-http-server-buffer-underwrite-in-ap-regname-via) (info, published 8 Jun 2026)
- [CVE-2026-44186: Apache HTTP Server infinite loop in mod_proxy_ftp](https://junglewise.ai/threats/cve-2026-44186-apache-http-server-infinite-loop-in-mod-proxy-ftp) (info, published 8 Jun 2026)
- [CVE-2026-44185: Apache HTTP Server buffer over-read in mod_ssl OCSP send_request](https://junglewise.ai/threats/cve-2026-44185-apache-http-server-buffer-over-read-in-mod-ssl-ocsp-send-request) (info, CVSS 0, published 8 Jun 2026)

## Most severe Apache HTTP Server vulnerabilities

- [CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2021-41773-apache-http-server-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021)
- [CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2021-42013-apache-http-server-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021)
- [CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability](https://junglewise.ai/threats/cve-2024-38475-apache-http-server-improper-escaping-of-output-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 1 May 2025)
- [CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)](https://junglewise.ai/threats/cve-2021-40438-apache-http-server-side-request-forgery-ssrf) (critical, exploited in the wild, CVSS 9, published 1 Dec 2021)
- [CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2019-0211-apache-http-server-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 3 Nov 2021)
- [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023)
- [CVE-1999-0067: NCSA/Apache phf CGI program OS command injection](https://junglewise.ai/threats/cve-1999-0067-ncsa-apache-phf-cgi-program-os-command-injection) (critical, CVSS 10, published 20 Mar 1996)
- [CVE-2026-28780: Apache HTTP Server heap overflow in mod_proxy_ajp](https://junglewise.ai/threats/cve-2026-28780-apache-http-server-heap-overflow-in-mod-proxy-ajp) (critical, CVSS 9.8, published 5 May 2026)
- [CVE-2026-57941: Apache HTTP Server mod_http2 use-after-free via shared session bbtmp](https://junglewise.ai/threats/cve-2026-57941-use-after-free-vulnerability-in-apache-http-server-s-mod-http2) (critical, CVSS 9.8, published 1 Oct 2026)
- [CVE-2026-56154: Apache HTTP Server mod_rewrite use-after-free via lookahead](https://junglewise.ai/threats/cve-2026-56154-use-after-free-vulnerability-in-apache-http-server-s-mod-rewrite) (critical, CVSS 9.8, published 1 Oct 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 17 vulnerabilities in the four before. 0 critical against 3.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 1 | 0 | 0 |
| 28 Sep 2026 | 16 | 3 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 3 | 0 | 0 |

## Other Apache technologies

- [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities
- [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities
- [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities
- [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities
- [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities
- [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities
- [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities
- [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities
- [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities
- [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities
- [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities
- [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket): 23 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache HTTP Server vulnerabilities", https://junglewise.ai/threats/technologies/http-server, 12 November 2026.