CVE Tools
Track your stack

Apache HTTP Server

360 CVEs tracked. 6 of them are in CISA KEV.

This hub aggregates every CVE we track for Apache HTTP Server, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Apache HTTP Server CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Apache HTTP Server CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-041
2025-050
2025-060
2025-079
2025-080
2025-090
2025-100
2025-110
2025-125
2026-010
2026-020
2026-030
2026-040
2026-0511
2026-0613
2026-070
2026-080
2026-090
2026-1020

Severity

How the 360 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical4412%
  • High12334%
  • Medium17950%
  • Low144%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache HTTP Server.

  1. CVE-2026-63686Apache HTTP Server: mod_xml2enc crash on charset conversion failure7.5
  2. CVE-2026-93546Apache HTTP Server: mod_dav_fs namespace overflow8.8
  3. CVE-2026-79768Apache HTTP Server: mod_userdir information disclosure5.3
  4. CVE-2026-73637Apache HTTP Server: mod_auth_digest DoS attack7.3
  5. CVE-2026-73636Apache HTTP Server: mod_auth_digest one-time-nonce replay attack8.1
  6. CVE-2026-63718Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling7.5
  7. CVE-2026-63292Apache HTTP Server: mod_vhost_alias stack overflow7.5
  8. CVE-2026-63045Apache HTTP Server: mod_proxy_ftp PASV address handling7.5
  9. CVE-2026-59797Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function9.8
  10. CVE-2026-59685Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM7.5
  11. CVE-2026-58415Apache HTTP Server: mod_dav_fs property database read access5.3
  12. CVE-2026-57941Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy9.8
  13. CVE-2026-56449Apache HTTP Server: mod_proxy_html: crash in dump_content7.5
  14. CVE-2026-56154Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}9.8
  15. CVE-2026-56153Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char7.5

Product grouping is registry-driven, with AI assist and human review. How it works