https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:05:19.664560+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:1915 ALSA-2022:1915 — Moderate: httpd:2.4 security and bug fix update 2026-10-04T15:05:19.950398+00:00

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

* httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

* httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2021-06393 bdu:2021-06393 2026-10-04T15:05:19.950534+00:00 bdu:2021-06393 https://cve.radiocsirt.org/vuln/bell-cve-2021-44224 Withdrawn: BELL-CVE-2021-44224 — CVE-2021-44224 does not affect BellSoft software 2026-10-04T15:05:19.950562+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-apache-2021-44224 BIT-apache-2021-44224 — Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier 2026-10-04T15:05:19.950588+00:00

Affected: Bitnami: apache

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-972 certfr-2021-avi-972 — De multiples vulnérabilités ont été découvertes dans Apache httpd. Elles permettent à un attaquant de provoquer un déni… 2026-10-04T15:05:19.950636+00:00 certfr-2021-avi-972 https://cve.radiocsirt.org/vuln/cnvd-2021-102387 cnvd-2021-102387 2026-10-04T15:05:19.950661+00:00 cnvd-2021-102387 https://cve.radiocsirt.org/vuln/euvd-2026-32880 EUVD-2026-32880 2026-10-04T15:05:19.950682+00:00 EUVD-2026-32880 https://cve.radiocsirt.org/vuln/fkie_cve-2021-44224 fkie_cve-2021-44224 2026-10-04T15:05:19.950702+00:00

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

 https://cve.radiocsirt.org/vuln/ghsa-92ww-hwmg-qq7p GHSA-92ww-hwmg-qq7p 2026-10-04T15:05:19.950746+00:00

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

 https://cve.radiocsirt.org/vuln/gsd-2021-44224 gsd-2021-44224 2026-10-04T15:05:19.950812+00:00 gsd-2021-44224 https://cve.radiocsirt.org/vuln/msrc_cve-2021-44224 msrc_CVE-2021-44224 — Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier 2026-10-04T15:05:19.950832+00:00 msrc_CVE-2021-44224 https://cve.radiocsirt.org/vuln/oesa-2021-1473 OESA-2021-1473 — httpd security update 2026-10-04T15:05:19.950858+00:00

Affected: openEuler:20.03-LTS-SP1: httpd, openEuler:20.03-LTS-SP2: httpd

Apache HTTP Server. Security Fix(es): A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).(CVE-2021-44224) A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.(CVE-2021-44790)

 https://cve.radiocsirt.org/vuln/opensuse-su-2022:0091-1 openSUSE-SU-2022:0091-1 — Security update for apache2 2026-10-04T15:05:19.950902+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/rhsa-2022:6753 RHSA-2022:6753 — Red Hat Security Advisory: httpd24-httpd security and bug fix update 2026-10-04T15:05:19.950930+00:00

httpd: Request splitting via HTTP/2 method injection and mod_proxy httpd: NULL pointer dereference via malformed requests httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path httpd: Out-of-bounds write in ap_escape_quotes() via malicious input httpd: possible NULL dereference or SSRF in forward proxy configurations httpd: mod_lua: Use of uninitialized value of in r:parsebody httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody httpd: mod_sed: Read/write beyond bounds httpd: mod_proxy_ajp: Possible request smuggling httpd: Out-of-bounds read via ap_rwrite() httpd: Out-of-bounds read in ap_strcmp_match() httpd: mod_lua: DoS in r:parsebody httpd: mod_sed: DoS vulnerability httpd: mod_lua: Information disclosure with websockets httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

 https://cve.radiocsirt.org/vuln/suse-su-2022:0065-1 SUSE-SU-2022:0065-1 — Security update for apache2 2026-10-04T15:05:19.950999+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-44224 UBUNTU-CVE-2021-44224 2026-10-04T15:05:19.951025+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0302 WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator… 2026-10-04T15:05:19.951074+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.