https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:46:33.063969+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:1915 ALSA-2022:1915 — Moderate: httpd:2.4 security and bug fix update 2026-10-03T22:46:33.083961+00:00

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

* httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

* httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2021-04216 bdu:2021-04216 2026-10-03T22:46:33.084046+00:00 bdu:2021-04216 https://cve.radiocsirt.org/vuln/bell-cve-2021-33193 Withdrawn: BELL-CVE-2021-33193 — CVE-2021-33193 does not affect BellSoft software 2026-10-03T22:46:33.084063+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-apache-2021-33193 BIT-apache-2021-33193 — Request splitting via HTTP/2 method injection and mod_proxy 2026-10-03T22:46:33.084078+00:00

Affected: Bitnami: apache

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-713 certfr-2021-avi-713 — De multiples vulnérabilités ont été découvertes dans Apache httpd. Elles permettent à un attaquant de provoquer un prob… 2026-10-03T22:46:33.084099+00:00 certfr-2021-avi-713 https://cve.radiocsirt.org/vuln/euvd-2026-28298 EUVD-2026-28298 2026-10-03T22:46:33.084114+00:00 EUVD-2026-28298 https://cve.radiocsirt.org/vuln/fkie_cve-2021-33193 fkie_cve-2021-33193 2026-10-03T22:46:33.084124+00:00

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

 https://cve.radiocsirt.org/vuln/ghsa-p9fg-6rr5-38xc GHSA-p9fg-6rr5-38xc 2026-10-03T22:46:33.084145+00:00

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

 https://cve.radiocsirt.org/vuln/gsd-2021-33193 gsd-2021-33193 2026-10-03T22:46:33.084159+00:00 gsd-2021-33193 https://cve.radiocsirt.org/vuln/msrc_cve-2021-33193 msrc_CVE-2021-33193 — Request splitting via HTTP/2 method injection and mod_proxy 2026-10-03T22:46:33.084170+00:00 msrc_CVE-2021-33193 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1234-1 openSUSE-SU-2021:1234-1 — Security update for apache2 2026-10-03T22:46:33.084185+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/rhsa-2022:6753 RHSA-2022:6753 — Red Hat Security Advisory: httpd24-httpd security and bug fix update 2026-10-03T22:46:33.084199+00:00

httpd: Request splitting via HTTP/2 method injection and mod_proxy httpd: NULL pointer dereference via malformed requests httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path httpd: Out-of-bounds write in ap_escape_quotes() via malicious input httpd: possible NULL dereference or SSRF in forward proxy configurations httpd: mod_lua: Use of uninitialized value of in r:parsebody httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody httpd: mod_sed: Read/write beyond bounds httpd: mod_proxy_ajp: Possible request smuggling httpd: Out-of-bounds read via ap_rwrite() httpd: Out-of-bounds read in ap_strcmp_match() httpd: mod_lua: DoS in r:parsebody httpd: mod_sed: DoS vulnerability httpd: mod_lua: Information disclosure with websockets httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

 https://cve.radiocsirt.org/vuln/suse-su-2021:2918-1 SUSE-SU-2021:2918-1 — Security update for apache2 2026-10-03T22:46:33.084233+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-33193 UBUNTU-CVE-2021-33193 2026-10-03T22:46:33.084246+00:00

Affected: Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0722 WID-SEC-W-2022-0722 — Apache HTTP Server: Schwachstelle ermöglicht Denial of Service 2026-10-03T22:46:33.084265+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen.