Known Vulnerabilities for Apache HTTP Server by Apache Software Foundation
Listed below are 10 of the newest known vulnerabilities associated with "Apache HTTP Server" by "Apache Software Foundation".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-123779 json | Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforc... | Not Provided | 2026-11-09 | 2026-11-09 |
| CVE-2026-120367 json | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including... | Not Provided | 2026-11-09 | 2026-11-09 |
| CVE-2026-119342 json | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, ... | Not Provided | 2026-10-30 | 2026-11-05 |
| CVE-2026-114459 json | A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read me... | Not Provided | 2026-10-22 | 2026-10-26 |
| CVE-2026-111817 json | Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_c... | Not Provided | 2026-10-21 | 2026-10-23 |
| CVE-2026-111808 json | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. Th... | Not Provided | 2026-10-21 | 2026-10-23 |
| CVE-2026-111805 json | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. ... | Not Provided | 2026-10-21 | 2026-10-23 |
| CVE-2026-107938 json | In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname i... | Not Provided | 2026-10-09 | 2026-10-15 |
| CVE-2026-107460 json | Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0... | Not Provided | 2026-10-13 | 2026-10-20 |
| CVE-2026-105299 json | Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_req... | Not Provided | 2026-10-20 | 2026-10-20 |