https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:47:55.793375+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:1915 ALSA-2022:1915 — Moderate: httpd:2.4 security and bug fix update 2026-10-03T12:47:55.995706+00:00

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

* httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

* httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2021-03679 bdu:2021-03679 2026-10-03T12:47:55.995800+00:00 bdu:2021-03679 https://cve.radiocsirt.org/vuln/bell-cve-2020-35452 Withdrawn: BELL-CVE-2020-35452 — CVE-2020-35452 does not affect BellSoft software 2026-10-03T12:47:55.995819+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-apache-2020-35452 BIT-apache-2020-35452 — mod_auth_digest possible stack overflow by one nul byte 2026-10-03T12:47:55.995834+00:00

Affected: Bitnami: apache

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-897 certfr-2021-avi-897 — De multiples vulnérabilités ont été découvertes dans Zimbra. Elles permettent à un attaquant de provoquer un contournem… 2026-10-03T12:47:55.995856+00:00 certfr-2021-avi-897 https://cve.radiocsirt.org/vuln/cnvd-2021-70102 cnvd-2021-70102 2026-10-03T12:47:55.995871+00:00 cnvd-2021-70102 https://cve.radiocsirt.org/vuln/esba-2024:0591 ESBA-2024:0591 — bugfix update for CVE-2020-35452 for httpd 2026-10-03T12:47:55.995882+00:00

bugfix update for CVE-2020-35452 for httpd

 https://cve.radiocsirt.org/vuln/euvd-2026-47572 EUVD-2026-47572 2026-10-03T12:47:55.995899+00:00 EUVD-2026-47572 https://cve.radiocsirt.org/vuln/fkie_cve-2020-35452 fkie_cve-2020-35452 2026-10-03T12:47:55.995910+00:00

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

 https://cve.radiocsirt.org/vuln/ghsa-77mj-xh9q-fm9j GHSA-77mj-xh9q-fm9j 2026-10-03T12:47:55.995930+00:00

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

 https://cve.radiocsirt.org/vuln/gsd-2020-35452 gsd-2020-35452 2026-10-03T12:47:55.995945+00:00 gsd-2020-35452 https://cve.radiocsirt.org/vuln/msrc_cve-2020-35452 msrc_CVE-2020-35452 — mod_auth_digest possible stack overflow by one nul byte 2026-10-03T12:47:55.995956+00:00 msrc_CVE-2020-35452 https://cve.radiocsirt.org/vuln/oesa-2021-1246 OESA-2021-1246 — httpd security update 2026-10-03T12:47:55.995971+00:00

Affected: openEuler:20.03-LTS-SP1: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow(CVE-2021-26691) Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service(CVE-2020-13950) Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow(CVE-2020-35452)

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with MergeSlashes OFF(CVE-2021-30641)

 https://cve.radiocsirt.org/vuln/rhsa-2021:4613 RHSA-2021:4613 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update 2026-10-03T12:47:55.995997+00:00

httpd: mod_proxy_wstunnel tunneling of non Upgraded connection pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 httpd: mod_proxy NULL pointer dereference pcre: Integer overflow when parsing callout numeric arguments httpd: Single zero byte stack overflow in mod_auth_digest JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure openssl: Read buffer overruns processing ASN.1 strings openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash() httpd: mod_session: NULL pointer dereference when parsing Cookie header httpd: mod_session: Heap overflow via a crafted SessionHeader value httpd: Unexpected URL matching with 'MergeSlashes OFF' httpd: NULL pointer dereference via malformed requests

 https://cve.radiocsirt.org/vuln/suse-su-2021:14749-1 SUSE-SU-2021:14749-1 — Security update for apache2 2026-10-03T12:47:55.996035+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-35452 UBUNTU-CVE-2020-35452 2026-10-03T12:47:55.996051+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0438 WID-SEC-W-2022-0438 — Apache HTTP Server: Mehrere Schwachstellen 2026-10-03T12:47:55.996075+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.