Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

Apache HTTP Server: mod_rewrite proxy handler substitution

Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

Apache HTTP Server: HTTP response splitting

Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request …

In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) co…

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing confi…

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.