apache httpd

A partial upstream fix in Apache HTTP Server left an opening that can return source code instead of executing it — and Microsoft’s short advisory that “Azure Linux includes the implicated open‑source library and is therefore potentially affected” is correct for Azure Linux images but does not...

An encoding flaw in Apache HTTP Server’s mod_proxy can let crafted requests slip past intended authentication checks and reach backend services, potentially exposing protected resources — operators should treat this as an urgent configuration and patch-management issue and update affected...

The Apache HTTP Server vulnerability tracked as CVE-2024-47252 — an insufficient escaping flaw in mod_ssl that can allow a malicious TLS client to inject escape/control characters into log files — has been confirmed by Apache and fixed in the 2.4.64 release; Microsoft’s Security Response Center...

A critical HTTP response splitting vulnerability in the Apache HTTP Server — tracked as CVE-2024-42516 — has been confirmed and fixed upstream, but Microsoft’s public advisory language that “Azure Linux includes this open‑source library and is therefore potentially affected” has caused...

The discovery of CVE-2025-23048 — a session-resumption flaw in Apache HTTP Server’s mod_ssl — has sharpened attention on a familiar but persistent reality of modern software security: a vulnerability in a widely used open‑source component can pose ripple effects across diverse products and...

The Apache HTTP Server vulnerability tracked as CVE-2024-27316 — an HTTP/2 denial-of-service triggered by an attacker sending endless CONTINUATION frames that cause memory exhaustion — is real, fixed upstream in the Apache httpd releases, and Microsoft’s brief advisory that “Azure Linux includes...

A subtle integer overflow in Apache HTTP Server’s ACME integration (mod_md) can turn a sensible certificate renewal backoff into an incessant retry loop after an extended series of failures, creating sustained renewal storms and operational headaches for administrators — the issue is tracked as...

Apache HTTP Server has a Windows-only Server-Side Request Forgery (SSRF) flaw that can be forced to make the server connect to attacker-controlled UNC (SMB) targets and thereby leak NTLM authentication material — a vulnerability tracked as CVE-2025-59775 and fixed in Apache httpd 2.4.66...

The Apache HTTP Server project has published a security fix for CVE-2025-65082, a CGI environment variable override that affects Apache httpd 2.4.0 through 2.4.65 and is resolved in Apache httpd 2.4.66; administrators running CGI or mod_cgi/mod_cgid setups should prioritize upgrading and...