# Newest Apache HTTP Server CVEs The newest CVEs of Apache HTTP Server, named by vendor and product. Source: https://docs.deepinfo.com/reference/vulnerability/latest-added/examples/vendor-product/ Last updated: 2026-09-24 --- `GET https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&size=5` The newest CVEs of Apache HTTP Server, named by vendor and product. Example 2 of 4 in **Product** · [Latest Added Vulnerabilities Examples](/reference/vulnerability/latest-added/examples/) · endpoint: [Latest Added](/reference/vulnerability/latest-added/) Tags: `param` `vendor` · `param` `product` · `value` `apache` · `value` `http_server` `vendor` and `product` together name one product, with the CPE names Deepinfo uses. In the response, look at `[].enrichment.cpe[].product`. ## Request | Parameter | In | Value | |---|---|---| | `vendor` | query | `apache` | | `product` | query | `http_server` | | `size` | query | `5` | ```bash curl 'https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&size=5' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' ``` ## Response ### 200 · OK > Shortened for this page: items: 3 of 5 shown; [].references: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json [ { "id": "CVE-2026-49975", "source_identifier": "user@apache.org", "published": "2026-06-08T16:16:44Z", "last_modified": "2026-08-19T12:18:28Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\n\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67." }, { "lang": "es", "value": "Vulnerabilidad de asignación de memoria con valor de tamaño excesivo en el mod_http del Servidor HTTP Apache conduce a denegación de servicio a través de solicitudes HTTP maliciosas.\n\nEste problema afecta al Servidor HTTP Apache: desde 2.4.17 hasta 2.4.67." } ], "references": [ { "url": "https://httpd.apache.org/security/vulnerabilities_24.html", "source": "user@apache.org", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/03/3", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/08/16", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:25042", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:25057", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:25090", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:25225", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:27114", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:27200", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "NONE", "integrity_impact": "NONE", "availability_impact": "HIGH", "base_score": 7.5, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 3.6 }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "NONE", "integrity_impact": "NONE", "availability_impact": "HIGH", "base_score": 7.5, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 3.6 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-789" } ] }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-409" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "match_criteria_id": "DD819875-456D-45A6-90C9-4EDA544029A4", "version_start_including": "2.4.17", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.4.68" }, { "vulnerable": true, "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "match_criteria_id": "FA6FEEC2-9F11-4643-8827-749718254FED", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "vendor": "apache", "product": "http_server", "product_type": "a", "vulnerable": true, "version_start_including": "2.4.17", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.4.68", "affected_versions_first": "2.4.17", "affected_versions_last": "2.4.67" }, { "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vendor": "debian", "product": "debian_linux", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "11.0", "affected_versions_last": "11.0" } ], "cwe": [ { "id": 409, "owasptop10_2021": null, "name": "Improper Handling of Highly Compressed Data (Data Amplification)", "description": "The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.", "capec_id": null, "scope": [ "Availability" ], "impact": [ "DoS: Amplification", "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)" ], "detection_method": null }, { "id": 789, "owasptop10_2021": null, "name": "Memory Allocation with Excessive Size Value", "description": "The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.", "capec_id": null, "scope": [ "Availability" ], "impact": [ "DoS: Resource Consumption (Memory)" ], "detection_method": [ "Automated Dynamic Analysis", "Automated Static Analysis", "Fuzzing" ] } ], "epss_score": { "epss": 0.34303, "percentile": 0.98337, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "NONE", "vulnerable_system_integrity": "NONE", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 7.5, "base_severity": "HIGH" } } } }, { "id": "CVE-2026-48913", "source_identifier": "user@apache.org", "published": "2026-06-08T16:16:43Z", "last_modified": "2026-07-23T07:10:00Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.67." }, { "lang": "es", "value": "Vulnerabilidad de Uso Después de Liberar en el módulo mod_http2 del Servidor HTTP Apache cuando los descriptores de archivo ya están agotados.\n\nEste problema afecta al Servidor HTTP Apache: desde 2.4.55 hasta 2.4.67." } ], "references": [ { "url": "https://httpd.apache.org/security/vulnerabilities_24.html", "source": "user@apache.org", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/08/15", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "LOW", "integrity_impact": "LOW", "availability_impact": "LOW", "base_score": 7.3, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 3.4 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-416" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "match_criteria_id": "554E6D57-EA15-451A-A499-D20A39ADED3C", "version_start_including": "2.4.55", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.4.68" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "vendor": "apache", "product": "http_server", "product_type": "a", "vulnerable": true, "version_start_including": "2.4.55", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.4.68", "affected_versions_first": "2.4.55", "affected_versions_last": "2.4.67" } ], "cwe": [ { "id": 416, "owasptop10_2021": null, "name": "Use After Free", "description": "The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.", "capec_id": null, "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Modify Memory", "Read Memory" ], "detection_method": [ "Automated Dynamic Analysis", "Automated Static Analysis", "Fuzzing" ] } ], "epss_score": { "epss": 0.00479, "percentile": 0.40498, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "LOW", "vulnerable_system_integrity": "LOW", "vulnerable_system_availability": "LOW", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 7.3, "base_severity": "HIGH" } } } }, { "id": "CVE-2026-44631", "source_identifier": "user@apache.org", "published": "2026-06-08T16:16:40Z", "last_modified": "2026-07-23T07:10:00Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue." }, { "lang": "es", "value": "Vulnerabilidad de escritura insuficiente de búfer en el Servidor HTTP Apache en expresiones regulares manipuladas en la configuración.\n\nEste problema afecta al Servidor HTTP Apache: desde 2.4.0 hasta 2.4.67.\n\nSe recomienda a los usuarios actualizar a la versión 2.4.68, la cual corrige el problema." } ], "references": [ { "url": "https://httpd.apache.org/security/vulnerabilities_24.html", "source": "user@apache.org", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/08/14", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-124" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "match_criteria_id": "03F07E89-F9BF-4913-8250-F79447AA6EBD", "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.4.68" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "vendor": "apache", "product": "http_server", "product_type": "a", "vulnerable": true, "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.4.68", "affected_versions_first": "2.4.0", "affected_versions_last": "2.4.67" } ], "cwe": [ { "id": 124, "owasptop10_2021": null, "name": "Buffer Underwrite ('Buffer Underflow')", "description": "The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.", "capec_id": null, "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Other" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Modify Memory", "Other" ], "detection_method": [ "Automated Dynamic Analysis", "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00504, "percentile": 0.42156, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } } ] ``` ## Related Examples - [CVEs of Apache HTTP Server 2.4.49](/reference/vulnerability/latest-added/examples/vendor-product-version/) - [CVEs of Apache HTTP Server 2.2.x](/reference/vulnerability/latest-added/examples/version-startswith/) - [Newest Microsoft CVEs](/reference/vulnerability/latest-added/examples/vendor-microsoft/)