Apache · weakness class
Denial of Service
331 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 18
Every one of the 331 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
- mod_sed denial of service
- Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
- EncryptInterceptor does not provide complete protection on insecure networks
- Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
- Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
- Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
- Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
- Apache HTTP Server: mod_http2 denial of service
- Apache Tomcat: FileUpload large number of parts with headers DoS
- An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apac…
- In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server t…
- DoS for HTTP/2 connections by crafted requests
- The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a…
- DoS via memory leak with WebSocket connections
- Infinite loop within Apache XercesJ xml parser
- Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 6129…
- In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been pa…
- Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
- Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML…
- Response mix-up with WebSocket concurrent send and close
- In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were…
- Apache Struts: excessive disk usage
- In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details wil…
- The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. Thi…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.