https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:26:45.102326+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:0891 ALSA-2022:0891 — Moderate: httpd:2.4 security update 2026-10-02T15:26:45.408059+00:00

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session, AlmaLinux:8: mod_ssl

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: NULL pointer dereference via malformed requests (CVE-2021-34798)

* httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2021-05873 bdu:2021-05873 2026-10-02T15:26:45.408141+00:00 bdu:2021-05873 https://cve.radiocsirt.org/vuln/bell-cve-2021-34798 Withdrawn: BELL-CVE-2021-34798 — CVE-2021-34798 does not affect BellSoft software 2026-10-02T15:26:45.408159+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-apache-2021-34798 BIT-apache-2021-34798 — NULL pointer dereference in httpd core 2026-10-02T15:26:45.408175+00:00

Affected: Bitnami: apache

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-713 certfr-2021-avi-713 — De multiples vulnérabilités ont été découvertes dans Apache httpd. Elles permettent à un attaquant de provoquer un prob… 2026-10-02T15:26:45.408195+00:00 certfr-2021-avi-713 https://cve.radiocsirt.org/vuln/cnvd-2022-03223 cnvd-2022-03223 2026-10-02T15:26:45.408210+00:00 cnvd-2022-03223 https://cve.radiocsirt.org/vuln/euvd-2026-28877 EUVD-2026-28877 2026-10-02T15:26:45.408221+00:00 EUVD-2026-28877 https://cve.radiocsirt.org/vuln/fkie_cve-2021-34798 fkie_cve-2021-34798 2026-10-02T15:26:45.408231+00:00

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

 https://cve.radiocsirt.org/vuln/ghsa-6cg7-x9gh-4wf6 GHSA-6cg7-x9gh-4wf6 2026-10-02T15:26:45.408250+00:00

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

 https://cve.radiocsirt.org/vuln/gsd-2021-34798 gsd-2021-34798 2026-10-02T15:26:45.408263+00:00 gsd-2021-34798 https://cve.radiocsirt.org/vuln/icsa-22-132-02 ICSA-22-132-02 — Mitsubishi Electric MELSOFT iQ AppPortal 2026-10-02T15:26:45.408273+00:00

Apache HTTP Server Versions 2.4.0 to 2.4.46 allow unprivileged local users to stop httpd on Windows.CVE-2020-13938 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). In Apache HTTP Server Versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow.CVE-2021-26691 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server Versions 2.4.48 and earlier.CVE-2021-34798 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). An attacker who can present SM2 content for decryption to an application could cause data to overflow the buffer up to a maximum of 62 bytes, altering the contents of other data held after the buffer or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1 (Affected 1.1.1-1.1.1k). This issue is detailed further in CVE-2021-3711.CVE-2021-3711 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A carefully crafted request body can ca…

 https://cve.radiocsirt.org/vuln/msrc_cve-2021-34798 msrc_CVE-2021-34798 — NULL pointer dereference in httpd core 2026-10-02T15:26:45.408322+00:00 msrc_CVE-2021-34798 https://cve.radiocsirt.org/vuln/oesa-2021-1369 OESA-2021-1369 — httpd security update 2026-10-02T15:26:45.408337+00:00

Affected: openEuler:20.03-LTS-SP1: httpd, openEuler:20.03-LTS-SP2: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).(CVE-2021-36160) Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.(CVE-2021-34798) A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.(CVE-2021-40438)

 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1438-1 openSUSE-SU-2021:1438-1 — Security update for apache2 2026-10-02T15:26:45.408362+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/rhsa-2021:4613 RHSA-2021:4613 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update 2026-10-02T15:26:45.408379+00:00

httpd: mod_proxy_wstunnel tunneling of non Upgraded connection pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 httpd: mod_proxy NULL pointer dereference pcre: Integer overflow when parsing callout numeric arguments httpd: Single zero byte stack overflow in mod_auth_digest JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure openssl: Read buffer overruns processing ASN.1 strings openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash() httpd: mod_session: NULL pointer dereference when parsing Cookie header httpd: mod_session: Heap overflow via a crafted SessionHeader value httpd: Unexpected URL matching with 'MergeSlashes OFF' httpd: NULL pointer dereference via malformed requests

 https://cve.radiocsirt.org/vuln/suse-su-2021:3299-1 SUSE-SU-2021:3299-1 — Security update for apache2 2026-10-02T15:26:45.408415+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-34798 UBUNTU-CVE-2021-34798 2026-10-02T15:26:45.408431+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0724 WID-SEC-W-2022-0724 — Apache HTTP Server: Mehrere Schwachstellen 2026-10-02T15:26:45.408454+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand herzustellen.