https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:41:41.971434+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:34109 ALSA-2026:34109 — Important: httpd security, bug fix, and enhancement update 2026-10-03T23:41:42.457675+00:00

Affected: AlmaLinux:10: httpd, AlmaLinux:10: httpd-core, AlmaLinux:10: httpd-devel, AlmaLinux:10: httpd-filesystem, AlmaLinux:10: httpd-manual, AlmaLinux:10: httpd-tools, AlmaLinux:10: mod_ldap, AlmaLinux:10: mod_lua, AlmaLinux:10: mod_proxy_html, AlmaLinux:10: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

Bug Fix(es) and Enhancement(s):

* address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-08975 bdu:2025-08975 2026-10-03T23:41:42.457781+00:00 bdu:2025-08975 https://cve.radiocsirt.org/vuln/bell-cve-2024-42516 BELL-CVE-2024-42516 2026-10-03T23:41:42.457800+00:00

Affected: Alpaquita:23: apache2, Alpaquita:25: apache2, Alpaquita:stream: apache2

 https://cve.radiocsirt.org/vuln/bit-apache-2024-42516 BIT-apache-2024-42516 — Apache HTTP Server: HTTP response splitting 2026-10-03T23:41:42.457823+00:00

Affected: Bitnami: apache

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0586 certfr-2025-avi-0586 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu… 2026-10-03T23:41:42.457848+00:00 certfr-2025-avi-0586 https://cve.radiocsirt.org/vuln/cnvd-2025-16612 cnvd-2025-16612 2026-10-03T23:41:42.457864+00:00 cnvd-2025-16612 https://cve.radiocsirt.org/vuln/euvd-2026-259920 EUVD-2026-259920 2026-10-03T23:41:42.457875+00:00 EUVD-2026-259920 https://cve.radiocsirt.org/vuln/fkie_cve-2024-42516 fkie_cve-2024-42516 2026-10-03T23:41:42.457886+00:00

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.

 https://cve.radiocsirt.org/vuln/ghsa-5j7h-7m92-jgh4 GHSA-5j7h-7m92-jgh4 2026-10-03T23:41:42.457910+00:00

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.

 https://cve.radiocsirt.org/vuln/jvndb-2026-003905 jvndb-2026-003905 2026-10-03T23:41:42.457927+00:00

Multiple vulnerabilities have been found in Cosminexus HTTP Server and Hitachi Web Server. CVE-2024-42516, CVE-2024-47252 CVE-2024-47252 is not exploitable when SSL is not enabled.

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-42516 msrc_CVE-2024-42516 — Apache HTTP Server: HTTP response splitting 2026-10-03T23:41:42.457944+00:00 msrc_CVE-2024-42516 https://cve.radiocsirt.org/vuln/ncsc-2026-0027 NCSC-2026-0027 — Kwetsbaarheden verholpen in Oracle Fusion Middleware 2026-10-03T23:41:42.457961+00:00 NCSC-2026-0027 https://cve.radiocsirt.org/vuln/oesa-2025-2168 OESA-2025-2168 — httpd security update 2026-10-03T23:41:42.458015+00:00

Affected: openEuler:20.03-LTS-SP4: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es):

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)

SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.

Users are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.

In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)

In some mod_ssl configurations on Apache HTTP Server 2.4.35 th…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15360-1 openSUSE-SU-2025:15360-1 — apache2-2.4.64-1.1 on GA media 2026-10-03T23:41:42.458058+00:00

apache2-2.4.64-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:47046 RHSA-2026:47046 — Red Hat Security Advisory: httpd security update 2026-10-03T23:41:42.458080+00:00

httpd: incomplete fix for CVE-2023-38709 Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow httpd: NULL pointer dereference via specially crafted request httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

 https://cve.radiocsirt.org/vuln/rlsa-2026:34109 RLSA-2026:34109 — Important: httpd security, bug fix, and enhancement update 2026-10-03T23:41:42.458114+00:00

Affected: Rocky Linux:10: httpd

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)

* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)

* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

Bug Fix(es) and Enhancement(s):

* address Moderate severity issues from httpd 2.4.68 [rhel-10.2.z] (JIRA:Rocky Linux-184518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2025:02565-1 SUSE-SU-2025:02565-1 — Security update for apache2 2026-10-03T23:41:42.458147+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-42516 UBUNTU-CVE-2024-42516 2026-10-03T23:41:42.458167+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:Pro:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2, Ubuntu:25.10: apache2

HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which fixes this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1529 WID-SEC-W-2025-1529 — Apache HTTP Server: Mehrere Schwachstellen 2026-10-03T23:41:42.458197+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.