Latest Added Vulnerabilities Examples · Example 4 of 4 in Product

CVEs of Apache HTTP Server 2.2.x

GEThttps://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list

The newest CVEs that affect any Apache HTTP Server 2.2 release, with version__startswith.

Param: vendor product version__startswith
Value: apache http_server 2.2

version__startswith keeps the CVEs that affect any release whose version starts with the given text: 2.2 covers 2.2.0 to 2.2.x.

What to Notice

The newest Apache HTTP Server CVEs (CVE-2026-49975, CVE-2026-48913 and CVE-2026-44631, the first three of Newest Apache HTTP Server CVEs) are not in this list: their affected ranges start at 2.4.0 or later. The CVEs shown have a range with no lower bound that ends before 2.4.68 or 2.4.67 (version_end_excluding), so every 2.2 release is inside it: in [].enrichment.cpe[], affected_versions_first is 0.8.11 and affected_versions_last is 2.4.67 or 2.4.66.

Request

curl

curl 'https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&version__startswith=2.2&size=5' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list"

params = {
    "vendor": "apache",
    "product": "http_server",
    "version__startswith": "2.2",
    "size": "5"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, params=params, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&version__startswith=2.2&size=5";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&version__startswith=2.2&size=5", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&version__startswith=2.2&size=5"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&version__startswith=2.2&size=5");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&version__startswith=2.2&size=5',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list?vendor=apache&product=http_server&version__startswith=2.2&size=5')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: items: 3 of 5 shown; [].references: first 10 items

Response Body

[
  {
    "id": "CVE-2026-42535",
    "source_identifier": "user@apache.org",
    "published": "2026-06-08T16:16:39Z",
    "last_modified": "2026-07-23T07:10:00Z",
    "status": "Analyzed",
    "evaluator_comment": null,
    "evaluator_solution": null,
    "evaluator_impact": null,
    "cisa_exploit_add": null,
    "cisa_action_due": null,
    "cisa_required_action": null,
    "cisa_vulnerability_name": null,
    "descriptions": [
      {
        "lang": "en",
        "value": "A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Un problema de manejo de rutas en mod_dav_fs en Apache 2.4.67 y versiones anteriores permite a un autor de contenido WebDAV manipular directamente bases de datos de propiedades DAV confiables, lo que podría causar caídas de procesos hijo.\n\nSe recomienda a los usuarios actualizar a la versión 2.4.68, que corrige este problema."
      }
    ],
    "references": [
      {
        "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
        "source": "user@apache.org",
        "tags": [
          "Vendor Advisory"
        ]
      },
      {
        "url": "http://www.openwall.com/lists/oss-security/2026/06/08/8",
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ]
      }
    ],
    "metrics": {
      "cvss_metric_v40": null,
      "cvss_metric_v31": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "scope": "UNCHANGED",
            "confidentiality_impact": "NONE",
            "integrity_impact": "HIGH",
            "availability_impact": "HIGH",
            "base_score": 9.1,
            "base_severity": "CRITICAL",
            "exploit_code_maturity": null,
            "remediation_level": null,
            "report_confidence": null,
            "temporal_score": null,
            "temporal_severity": null,
            "confidentiality_requirement": null,
            "integrity_requirement": null,
            "availability_requirement": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_scope": null,
            "modified_confidentiality_impact": null,
            "modified_integrity_impact": null,
            "modified_availability_impact": null,
            "environmental_score": null,
            "environmental_severity": null
          },
          "exploitability_score": 3.9,
          "impact_score": 5.2
        }
      ],
      "cvss_metric_v30": null,
      "cvss_metric_v2": null
    },
    "weaknesses": [
      {
        "source": "user@apache.org",
        "type": "Secondary",
        "description": [
          {
            "lang": "en",
            "value": "CWE-668"
          }
        ]
      }
    ],
    "configurations": [
      {
        "operator": null,
        "negate": null,
        "nodes": [
          {
            "operator": "OR",
            "negate": false,
            "cpe_match": [
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
                "match_criteria_id": "99E49AE2-004B-40C1-AAD2-26DF36DDCBBA",
                "version_start_including": null,
                "version_start_excluding": null,
                "version_end_including": null,
                "version_end_excluding": "2.4.68"
              }
            ]
          }
        ]
      }
    ],
    "vendor_comments": null,
    "enrichment": {
      "cpe": [
        {
          "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
          "vendor": "apache",
          "product": "http_server",
          "product_type": "a",
          "vulnerable": true,
          "version_start_including": null,
          "version_start_excluding": null,
          "version_end_including": null,
          "version_end_excluding": "2.4.68",
          "affected_versions_first": "0.8.11",
          "affected_versions_last": "2.4.67"
        }
      ],
      "cwe": [
        {
          "id": 668,
          "owasptop10_2021": "A01 Broken Access Control",
          "name": "Exposure of Resource to Wrong Sphere",
          "description": "The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.",
          "capec_id": null,
          "scope": [
            "Confidentiality",
            "Integrity",
            "Other"
          ],
          "impact": [
            "Modify Application Data",
            "Read Application Data",
            "Varies by Context"
          ],
          "detection_method": null
        }
      ],
      "epss_score": {
        "epss": 0.00538,
        "percentile": 0.44266,
        "date": "2026-09-23"
      },
      "cisa_kev": null,
      "vdeep_metric": {
        "available_versions": [
          "3.1"
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvss_data": {
          "version": "3.1",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "attack_vector": "NETWORK",
          "attack_complexity": "LOW",
          "attack_requirements": null,
          "privileges_required": "NONE",
          "user_interaction": "NONE",
          "vulnerable_system_confidentiality": "NONE",
          "vulnerable_system_integrity": "HIGH",
          "vulnerable_system_availability": "HIGH",
          "subsequent_system_confidentiality": null,
          "subsequent_system_integrity": null,
          "subsequent_system_availability": null,
          "exploit_maturity": null,
          "confidentiality_requirements": null,
          "integrity_requirements": null,
          "availability_requirements": null,
          "modified_attack_vector": null,
          "modified_attack_complexity": null,
          "modified_attack_requirements": null,
          "modified_privileges_required": null,
          "modified_user_interaction": null,
          "modified_vulnerable_system_confidentiality": null,
          "modified_vulnerable_system_integrity": null,
          "modified_vulnerable_system_availability": null,
          "modified_subsequent_system_confidentiality": null,
          "modified_subsequent_system_integrity": null,
          "modified_subsequent_system_availability": null,
          "safety": null,
          "automatable": null,
          "recovery": null,
          "value_density": null,
          "vulnerability_response_effort": null,
          "provider_urgency": null,
          "base_score": 9.1,
          "base_severity": "CRITICAL"
        }
      }
    }
  },
  {
    "id": "CVE-2026-29170",
    "source_identifier": "user@apache.org",
    "published": "2026-06-08T16:16:38Z",
    "last_modified": "2026-07-23T07:10:00Z",
    "status": "Analyzed",
    "evaluator_comment": null,
    "evaluator_solution": null,
    "evaluator_impact": null,
    "cisa_exploit_add": null,
    "cisa_action_due": null,
    "cisa_required_action": null,
    "cisa_vulnerability_name": null,
    "descriptions": [
      {
        "lang": "en",
        "value": "A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Existe una vulnerabilidad de cross-site scripting en la generación de listas de directorios HTML de mod_proxy_ftp en Servidor HTTP Apache 2.4.67 y anteriores al listar contenidos de directorios FTP ya sea a través de configuración de proxy directo o inverso.\n\nSe recomienda a los usuarios actualizar a la versión 2.4.68, que corrige este problema."
      }
    ],
    "references": [
      {
        "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
        "source": "user@apache.org",
        "tags": [
          "Vendor Advisory"
        ]
      },
      {
        "url": "http://www.openwall.com/lists/oss-security/2026/06/08/5",
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ]
      }
    ],
    "metrics": {
      "cvss_metric_v40": null,
      "cvss_metric_v31": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "privileges_required": "NONE",
            "user_interaction": "REQUIRED",
            "scope": "CHANGED",
            "confidentiality_impact": "LOW",
            "integrity_impact": "LOW",
            "availability_impact": "NONE",
            "base_score": 6.1,
            "base_severity": "MEDIUM",
            "exploit_code_maturity": null,
            "remediation_level": null,
            "report_confidence": null,
            "temporal_score": null,
            "temporal_severity": null,
            "confidentiality_requirement": null,
            "integrity_requirement": null,
            "availability_requirement": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_scope": null,
            "modified_confidentiality_impact": null,
            "modified_integrity_impact": null,
            "modified_availability_impact": null,
            "environmental_score": null,
            "environmental_severity": null
          },
          "exploitability_score": 2.8,
          "impact_score": 2.7
        }
      ],
      "cvss_metric_v30": null,
      "cvss_metric_v2": null
    },
    "weaknesses": [
      {
        "source": "user@apache.org",
        "type": "Secondary",
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ]
      }
    ],
    "configurations": [
      {
        "operator": null,
        "negate": null,
        "nodes": [
          {
            "operator": "OR",
            "negate": false,
            "cpe_match": [
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
                "match_criteria_id": "99E49AE2-004B-40C1-AAD2-26DF36DDCBBA",
                "version_start_including": null,
                "version_start_excluding": null,
                "version_end_including": null,
                "version_end_excluding": "2.4.68"
              }
            ]
          }
        ]
      }
    ],
    "vendor_comments": null,
    "enrichment": {
      "cpe": [
        {
          "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
          "vendor": "apache",
          "product": "http_server",
          "product_type": "a",
          "vulnerable": true,
          "version_start_including": null,
          "version_start_excluding": null,
          "version_end_including": null,
          "version_end_excluding": "2.4.68",
          "affected_versions_first": "0.8.11",
          "affected_versions_last": "2.4.67"
        }
      ],
      "cwe": [
        {
          "id": 79,
          "owasptop10_2021": "A03 Injection",
          "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
          "description": "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.",
          "capec_id": [
            63,
            85,
            209,
            588,
            591,
            592
          ],
          "scope": [
            "Access Control",
            "Availability",
            "Confidentiality",
            "Integrity"
          ],
          "impact": [
            "Bypass Protection Mechanism",
            "Execute Unauthorized Code or Commands",
            "Read Application Data"
          ],
          "detection_method": [
            "Automated Static Analysis",
            "Black Box"
          ]
        }
      ],
      "epss_score": {
        "epss": 0.00523,
        "percentile": 0.43367,
        "date": "2026-09-23"
      },
      "cisa_kev": null,
      "vdeep_metric": {
        "available_versions": [
          "3.1"
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvss_data": {
          "version": "3.1",
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "attack_vector": "NETWORK",
          "attack_complexity": "LOW",
          "attack_requirements": null,
          "privileges_required": "NONE",
          "user_interaction": "REQUIRED",
          "vulnerable_system_confidentiality": "LOW",
          "vulnerable_system_integrity": "LOW",
          "vulnerable_system_availability": "NONE",
          "subsequent_system_confidentiality": null,
          "subsequent_system_integrity": null,
          "subsequent_system_availability": null,
          "exploit_maturity": null,
          "confidentiality_requirements": null,
          "integrity_requirements": null,
          "availability_requirements": null,
          "modified_attack_vector": null,
          "modified_attack_complexity": null,
          "modified_attack_requirements": null,
          "modified_privileges_required": null,
          "modified_user_interaction": null,
          "modified_vulnerable_system_confidentiality": null,
          "modified_vulnerable_system_integrity": null,
          "modified_vulnerable_system_availability": null,
          "modified_subsequent_system_confidentiality": null,
          "modified_subsequent_system_integrity": null,
          "modified_subsequent_system_availability": null,
          "safety": null,
          "automatable": null,
          "recovery": null,
          "value_density": null,
          "vulnerability_response_effort": null,
          "provider_urgency": null,
          "base_score": 6.1,
          "base_severity": "MEDIUM"
        }
      }
    }
  },
  {
    "id": "CVE-2026-28780",
    "source_identifier": "user@apache.org",
    "published": "2026-05-05T22:16:00Z",
    "last_modified": "2026-09-14T13:17:54Z",
    "status": "Modified",
    "evaluator_comment": null,
    "evaluator_solution": null,
    "evaluator_impact": null,
    "cisa_exploit_add": null,
    "cisa_action_due": null,
    "cisa_required_action": null,
    "cisa_vulnerability_name": null,
    "descriptions": [
      {
        "lang": "en",
        "value": "Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de desbordamiento de búfer basado en montículo en mod_proxy_ajp del Servidor HTTP Apache.\nSi mod_proxy_ajp se conecta a un servidor AJP malicioso, este servidor AJP puede enviar un mensaje AJP malicioso de vuelta a mod_proxy_ajp y hacer que escriba 4 bytes controlados por el atacante después del final de un búfer basado en montículo.\n\nEste problema afecta al Servidor HTTP Apache: hasta 2.4.66.\n\nSe recomienda a los usuarios actualizar a la versión 2.4.67, que corrige el problema."
      }
    ],
    "references": [
      {
        "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
        "source": "user@apache.org",
        "tags": [
          "Release Notes",
          "Vendor Advisory"
        ]
      },
      {
        "url": "http://www.openwall.com/lists/oss-security/2026/05/05/9",
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ]
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:21391",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:21433",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:22140",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:27200",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:27201",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:36373",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:36831",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      },
      {
        "url": "https://access.redhat.com/errata/RHSA-2026:36846",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "tags": null
      }
    ],
    "metrics": {
      "cvss_metric_v40": null,
      "cvss_metric_v31": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "scope": "UNCHANGED",
            "confidentiality_impact": "HIGH",
            "integrity_impact": "HIGH",
            "availability_impact": "HIGH",
            "base_score": 9.8,
            "base_severity": "CRITICAL",
            "exploit_code_maturity": null,
            "remediation_level": null,
            "report_confidence": null,
            "temporal_score": null,
            "temporal_severity": null,
            "confidentiality_requirement": null,
            "integrity_requirement": null,
            "availability_requirement": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_scope": null,
            "modified_confidentiality_impact": null,
            "modified_integrity_impact": null,
            "modified_availability_impact": null,
            "environmental_score": null,
            "environmental_severity": null
          },
          "exploitability_score": 3.9,
          "impact_score": 5.9
        },
        {
          "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "HIGH",
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "scope": "UNCHANGED",
            "confidentiality_impact": "HIGH",
            "integrity_impact": "HIGH",
            "availability_impact": "HIGH",
            "base_score": 8.1,
            "base_severity": "HIGH",
            "exploit_code_maturity": null,
            "remediation_level": null,
            "report_confidence": null,
            "temporal_score": null,
            "temporal_severity": null,
            "confidentiality_requirement": null,
            "integrity_requirement": null,
            "availability_requirement": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_scope": null,
            "modified_confidentiality_impact": null,
            "modified_integrity_impact": null,
            "modified_availability_impact": null,
            "environmental_score": null,
            "environmental_severity": null
          },
          "exploitability_score": 2.2,
          "impact_score": 5.9
        }
      ],
      "cvss_metric_v30": null,
      "cvss_metric_v2": null
    },
    "weaknesses": [
      {
        "source": "user@apache.org",
        "type": "Secondary",
        "description": [
          {
            "lang": "en",
            "value": "CWE-122"
          }
        ]
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ]
      }
    ],
    "configurations": [
      {
        "operator": null,
        "negate": null,
        "nodes": [
          {
            "operator": "OR",
            "negate": false,
            "cpe_match": [
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
                "match_criteria_id": "8FF781BA-CF81-400B-A155-4DAE0BD856EE",
                "version_start_including": null,
                "version_start_excluding": null,
                "version_end_including": null,
                "version_end_excluding": "2.4.67"
              }
            ]
          }
        ]
      }
    ],
    "vendor_comments": null,
    "enrichment": {
      "cpe": [
        {
          "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
          "vendor": "apache",
          "product": "http_server",
          "product_type": "a",
          "vulnerable": true,
          "version_start_including": null,
          "version_start_excluding": null,
          "version_end_including": null,
          "version_end_excluding": "2.4.67",
          "affected_versions_first": "0.8.11",
          "affected_versions_last": "2.4.66"
        }
      ],
      "cwe": [
        {
          "id": 122,
          "owasptop10_2021": null,
          "name": "Heap-based Buffer Overflow",
          "description": "A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().",
          "capec_id": [
            92
          ],
          "scope": [
            "Access Control",
            "Availability",
            "Confidentiality",
            "Integrity",
            "Other"
          ],
          "impact": [
            "Bypass Protection Mechanism",
            "DoS: Crash, Exit, or Restart",
            "DoS: Resource Consumption (CPU)",
            "DoS: Resource Consumption (Memory)",
            "Execute Unauthorized Code or Commands",
            "Modify Memory",
            "Other"
          ],
          "detection_method": [
            "Automated Dynamic Analysis",
            "Fuzzing"
          ]
        },
        {
          "id": 787,
          "owasptop10_2021": null,
          "name": "Out-of-bounds Write",
          "description": "The product writes data past the end, or before the beginning, of the intended buffer.",
          "capec_id": null,
          "scope": [
            "Availability",
            "Integrity",
            "Other"
          ],
          "impact": [
            "DoS: Crash, Exit, or Restart",
            "Execute Unauthorized Code or Commands",
            "Modify Memory",
            "Unexpected State"
          ],
          "detection_method": [
            "Automated Dynamic Analysis",
            "Automated Static Analysis"
          ]
        }
      ],
      "epss_score": {
        "epss": 0.01376,
        "percentile": 0.70872,
        "date": "2026-09-23"
      },
      "cisa_kev": null,
      "vdeep_metric": {
        "available_versions": [
          "3.1"
        ],
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvss_data": {
          "version": "3.1",
          "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attack_vector": "NETWORK",
          "attack_complexity": "HIGH",
          "attack_requirements": null,
          "privileges_required": "NONE",
          "user_interaction": "NONE",
          "vulnerable_system_confidentiality": "HIGH",
          "vulnerable_system_integrity": "HIGH",
          "vulnerable_system_availability": "HIGH",
          "subsequent_system_confidentiality": null,
          "subsequent_system_integrity": null,
          "subsequent_system_availability": null,
          "exploit_maturity": null,
          "confidentiality_requirements": null,
          "integrity_requirements": null,
          "availability_requirements": null,
          "modified_attack_vector": null,
          "modified_attack_complexity": null,
          "modified_attack_requirements": null,
          "modified_privileges_required": null,
          "modified_user_interaction": null,
          "modified_vulnerable_system_confidentiality": null,
          "modified_vulnerable_system_integrity": null,
          "modified_vulnerable_system_availability": null,
          "modified_subsequent_system_confidentiality": null,
          "modified_subsequent_system_integrity": null,
          "modified_subsequent_system_availability": null,
          "safety": null,
          "automatable": null,
          "recovery": null,
          "value_density": null,
          "vulnerability_response_effort": null,
          "provider_urgency": null,
          "base_score": 8.1,
          "base_severity": "HIGH"
        }
      }
    }
  }
]

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Latest Added; the exact request is in the code panel.

Parameter	Value
`vendor`query	`apache`
`product`query	`http_server`
`version__startswith`query	`2.2`
`size`query	`5`

Reference updated September 24, 2026

Request

Related Examples