CyberSIXT Search
Apache product

HTTP Server

← All Apache products

No CISA KEV deadline is open. CISA last added a HTTP Server CVE on 1 May 2025.

Tracked since 5 May · latest article Fri 2 Oct · RSS

Added to KEV · 90 days
0
of 4 in the full CISA catalogue · all time
High exploit odds · current
1
EPSS top 5%, not in KEV
Articles · 7 days
0
none this week

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2024-38475not in CyberSIXT coverageHTTP Server1 May 2025Deadline passed 22 May 2025
CVE-2021-41773not in CyberSIXT coverageHTTP Server3 Nov 2021Deadline passed 17 Nov 2021Known ransomware use
CVE-2021-42013not in CyberSIXT coverageHTTP Server3 Nov 2021Deadline passed 17 Nov 2021Known ransomware use
CVE-2019-0211not in CyberSIXT coverageHTTP Server3 Nov 2021Deadline passed 3 May 2022

Coverage

5 articles · all timeFull timeline

5 articles from 4 outlets since 5 May; the latest 25 days ago.

HTTP Server: coverage over time5 articles from 4 outlets. First report 5 May by SecurityWeek. Busiest week: 3 articles, week of 4 May. 0 in the last 7 days. HTTP Server: coverage over time5 articles from 4 outlets. First report 5 May by SecurityWeek. Busiest week: 3 articles, week of 4 May. 0 in the last 7 days.
  • Article
  • First report
Show as table
HTTP Server: articles
Published (UTC)OutletHeadline
Fri 2 Oct · 03:36 UTCSecurityOnlineApache Fixes 20 Flaws Including Critical mod_vhost_alias Bug
Tue 9 Jun · 03:01 UTCSecurityOnlineApache HTTP Server 2.4.68 fixes critical bugs to protect systems
Wed 6 May · 11:11 UTCSecurity AffairsApache fixes HTTP/2 double‑free bug that could lead to RCE
Tue 5 May · 17:08 UTCThe Hacker NewsApache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918
Tue 5 May · 11:42 UTCSecurityWeekApache patches HTTP Server and MINA flaws, warns of RCE risk

Who reported 4 outlets, last 12 months

  • SecurityOnline2
  • SecurityWeek1
  • The Hacker News1
  • Security Affairs1
  1. Apache Fixes 20 Flaws Including Critical mod_vhost_alias BugSecurityOnline
  2. Apache HTTP Server 2.4.68 fixes critical bugs to protect systemsSecurityOnline
  3. Apache fixes HTTP/2 double‑free bug that could lead to RCESecurity Affairs
  4. Apache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918The Hacker News
  5. Apache patches HTTP Server and MINA flaws, warns of RCE riskSecurityWeek

All CVEs in coverage

16
CVE-2026-23918Apache Software Foundation Apache HTTP Server vulnerabilityCVSS8.8High–Not in KEV50%EPSS3articles
CVE-2026-28780Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()CVSS9.8Critical–Not in KEV1.4%EPSS1article
CVE-2026-34355Apache HTTP Server: mod_proxy_html buffer overflowCVSS7.5High–Not in KEV1.2%EPSS1article
CVE-2026-63292Apache HTTP Server: mod_vhost_alias stack overflowCVSS7.5High–Not in KEV0.9%EPSS1article
CVE-2026-34356Apache HTTP Server: ProxyPassReverseCookieMap buffer overflowCVSS7.5High–Not in KEV0.7%EPSS1article
CVE-2026-24072Apache Software Foundation Apache HTTP Server vulnerabilityCVSS8.8High–Not in KEV0.7%EPSS1article
CVE-2026-29168Apache HTTP Server: mod_md unrestricted OCSP responseCVSS7.3High–Not in KEV0.6%EPSS1article
CVE-2026-29169Apache Software Foundation Apache HTTP Server vulnerabilityCVSS7.5High–Not in KEV0.6%EPSS1article
CVE-2026-57941Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancyCVSS9.8Critical–Not in KEV0.6%EPSS1article
CVE-2026-56154Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}CVSS9.8Critical–Not in KEV0.5%EPSS0articles
CVE-2026-33007Apache Software Foundation Apache HTTP Server vulnerabilityCVSS5.3Medium–Not in KEV0.5%EPSS1article
CVE-2026-59797Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-functionCVSS9.8Critical–Not in KEV0.5%EPSS0articles
4 more CVEs
CVE-2026-59685Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEMCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-93546Apache HTTP Server: mod_dav_fs namespace overflowCVSS8.8High–Not in KEV0.4%EPSS1article
CVE-2026-42356Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directoriesCVSS3.7Low–Not in KEV0.4%EPSS1article
CVE-2026-42528Apache HTTP Server: mod_dav shared lock overflowCVSS4.3Medium–Not in KEV0.4%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device