Apache httpd 2.4 vulnerabilities 2021–2026: the CVEs that matter

Updated November 2026

As of November 2026 the latest Apache HTTP Server release is 2.4.69, released on 2026-10-01. It fixes 20 CVEs, and every earlier 2.4.x version is affected by at least some of them. If you build from source, upgrade to 2.4.69. If you use distribution packages, the upstream version number alone does not tell you whether you are safe. Check your distribution's security tracker instead.

2.4.69Latest release, 2026-10-01 (as of November 2026)
20CVEs fixed in 2.4.69 (5 moderate, 15 low)
44CVEs fixed in the three 2026 releases, 2.4.67 to 2.4.69
3httpd CVEs from 2021–2026 on the CISA Known Exploited list

Where these facts come from

Every CVE id, severity rating, "fixed in" version and date on this page is copied from the httpd project's own list, Apache HTTP Server 2.4 vulnerabilities, as it read in early November 2026. The descriptions are short summaries in our own words. The project's page has the full text, the affected version ranges and the people who reported each issue. Check it before you rely on any single entry, because the project sometimes updates entries after a release.

The severity column uses the httpd security team's four impact levels:

Critical: A remote attacker could potentially make Apache run arbitrary code. These are the bugs a worm could exploit automatically.
Important: Could compromise data or availability: an easy remote denial of service, reading files outside the document root, or getting around authentication or limits.
Moderate: Real flaws with significant mitigation, for example an uncommon configuration, a module few people load, or an attacker who must already be authenticated.
Low: Everything else: very hard to exploit, or minimal consequences.

Distributions and NVD often give the same CVE a different score. Red Hat, for example, rates CVE-2024-38474 as Important, with a CVSS 3.1 base score of 9.8. The httpd team rates each flaw against Apache's own code. Your risk depends on which modules and features your configuration actually uses.

Recent releases at a glance

Apache httpd 2.4 releases that fixed security issues, 2021–2026
Release	Date	CVEs fixed	Severity mix (httpd team)
2.4.69	2026-10-01	20	5 moderate, 15 low
2.4.68	2026-06-08	13	6 moderate, 7 low
2.4.67	2026-05-04	11	1 important, 2 moderate, 8 low
2.4.66	2025-12-04	5	3 moderate, 2 low
2.4.65	2025-07-23	1	1 moderate
2.4.64	2025-07-10	8	5 moderate, 3 low
2.4.62	2024-07-17	2	2 important
2.4.61	2024-07-03	1	1 important
2.4.60	2024-07-01	8	5 important, 2 moderate, 1 low
2.4.59	2024-04-04	3	2 moderate, 1 low
2.4.58	2023-10-19	3	1 moderate, 2 low
2.4.56	2023-03-07	2	1 important, 1 moderate
2.4.55	2023-01-17	3	3 moderate
2.4.54	2022-06-08	8	1 moderate, 7 low
2.4.53	2022-03-14	4	2 important, 1 moderate, 1 low
2.4.52	2021-12-20	2	1 important, 1 moderate
2.4.51	2021-10-07	1	1 critical
2.4.50	2021-10-04	2	1 critical, 1 moderate
2.4.49	2021-09-16	5	1 important, 3 moderate, 1 low
2.4.48	2021-06-01	8	1 important, 3 moderate, 4 low

Releases that fixed no security issues do not appear on the project's list, so they are not in this table either.

The most important CVEs, 2024–2026

Selected httpd 2.4 CVEs fixed from 2024 to October 2026
CVE	Severity	Fixed in	Date	What it is
CVE-2026-57941	Moderate	2.4.69	2026-10-01	Use-after-free in mod_http2 (affects 2.4.17 through 2.4.68).
CVE-2026-63292	Moderate	2.4.69	2026-10-01	Stack overflow in mod_vhost_alias: denial of service or possibly code execution. Requires VirtualDocumentRoot with a hostname format specifier and a LimitRequestFieldSize raised above the default.
CVE-2026-42528	Moderate	2.4.69	2026-10-01	mod_dav: a user who may create WebDAV locks can crash child processes.
CVE-2026-44119	Moderate	2.4.68	2026-06-08	Expressions in .htaccess (several modules) let .htaccess authors read files with the server user's privileges.
CVE-2026-49975	Moderate	2.4.68	2026-06-08	HTTP/2 denial of service through an oversized memory allocation.
CVE-2026-34355	Moderate	2.4.68	2026-06-08	Buffer overflow in mod_proxy_html that an untrusted backend can trigger.
CVE-2026-23918	Important	2.4.67	2026-05-04	HTTP/2 double free and possible remote code execution on early stream reset. Affects 2.4.66 only.
CVE-2026-24072	Moderate	2.4.67	2026-05-04	mod_rewrite and other modules: .htaccess authors can read files as the server user through ap_expr.
CVE-2026-33006	Moderate	2.4.67	2026-05-04	Timing attack that bypasses mod_auth_digest authentication in 2.4.66.
CVE-2025-58098	Moderate	2.4.66	2025-12-04	With SSI and mod_cgid, the query string was passed to `#exec cmd=` directives.
CVE-2025-66200	Moderate	2.4.66	2025-12-04	mod_userdir plus suexec: users with RequestHeader in .htaccess could run CGI under an unexpected user id.
CVE-2025-54090	Moderate	2.4.65	2025-07-23	Regression in 2.4.64: every `RewriteCond expr` test evaluated as true.
CVE-2025-53020	Moderate	2.4.64	2025-07-10	HTTP/2 denial of service by memory growth (2.4.17 through 2.4.63).
CVE-2025-49812	Moderate	2.4.64	2025-07-10	mod_ssl "TLS upgrade" (`SSLEngine optional`) allowed session hijacking by a man in the middle. 2.4.64 removed TLS upgrade support.
CVE-2025-23048	Moderate	2.4.64	2025-07-10	mod_ssl access-control bypass through TLS 1.3 session resumption between virtual hosts with different client-certificate CAs.
CVE-2024-42516	Moderate	2.4.64	2025-07-10	HTTP response splitting in the core. The fix for CVE-2023-38709 in 2.4.59 was incomplete.
CVE-2024-40725	Important	2.4.62	2024-07-17	Source code disclosure (for example PHP served as text) with handlers set through AddType. Partial fix of CVE-2024-39884.
CVE-2024-40898	Important	2.4.62	2024-07-17	Windows only: SSRF with mod_rewrite in server or virtual host context could leak NTLM hashes.
CVE-2024-39884	Important	2.4.61	2024-07-03	Regression in 2.4.60: some AddType handler configurations were ignored, disclosing source code.
CVE-2024-38475	Important	2.4.60	2024-07-01	mod_rewrite improper escaping: URLs could map to files that should not be reachable, leading to code execution or source disclosure. On CISA's Known Exploited list since 2025-05-01.
CVE-2024-38474	Important	2.4.60	2024-07-01	mod_rewrite: encoded question marks in backreferences could run scripts or disclose source.
CVE-2024-38476	Important	2.4.60	2024-07-01	Malicious backend response headers could cause information disclosure, SSRF or local script execution through internal redirects.
CVE-2024-38477	Important	2.4.60	2024-07-01	NULL pointer crash (denial of service) in mod_proxy from a malicious request.
CVE-2024-38472	Important	2.4.60	2024-07-01	Windows only: UNC-path SSRF that could leak NTLM hashes. Added the UNCList directive.
CVE-2024-27316	Moderate	2.4.59	2024-04-04	HTTP/2 memory exhaustion from endless CONTINUATION frames.

The most important CVEs, 2021–2023

Selected httpd 2.4 CVEs fixed from 2021 to 2023
CVE	Severity	Fixed in	Date	What it is
CVE-2023-45802	Moderate	2.4.58	2023-10-19	HTTP/2 stream memory not freed right away after a client reset (RST), so memory could keep growing.
CVE-2023-25690	Important	2.4.56	2023-03-07	HTTP request smuggling when mod_proxy is used with RewriteRule or ProxyPassMatch patterns that copy user input into the proxied URL.
CVE-2022-22720	Important	2.4.53	2022-03-14	Request smuggling: the connection was not closed after an error while discarding a request body.
CVE-2022-23943	Important	2.4.53	2022-03-14	Out-of-bounds heap write in mod_sed.
CVE-2021-44790	Important	2.4.52	2021-12-20	Buffer overflow in the mod_lua multipart parser (`r:parsebody()`).
CVE-2021-42013	Critical	2.4.51	2021-10-07	Path traversal and remote code execution in 2.4.49 and 2.4.50. The 2.4.50 fix for CVE-2021-41773 was incomplete. On CISA's Known Exploited list.
CVE-2021-41773	Critical	2.4.50	2021-10-04	Path traversal and file disclosure in 2.4.49 only. Exploited in the wild, and RCE if CGI was enabled for the aliased paths. On CISA's Known Exploited list.
CVE-2021-40438	Important	2.4.49	2021-09-16	mod_proxy SSRF: a crafted path could make the proxy forward to a server the attacker chose.

Patterns worth knowing

HTTP/2 shows up again and again (2023-45802, 2024-27316, 2025-53020, 2026-23918, 2026-49975, 2026-57941). If you enable Protocols h2, keep up with every release.
Proxy and rewrite rules that copy user input into a URL or a file path are behind many of the Important issues. The 2.4.60 fixes changed behavior on purpose: some RewriteRules now fail unless you add the UnsafeAllow3F or UnsafePrefixStat flags, and some old AddType handler setups must move to SetHandler. Test rewrite-heavy sites after upgrading. See mod_rewrite.
Optional modules (mod_dav, mod_lua, mod_sed, mod_proxy_ftp, mod_proxy_ajp, mod_auth_digest) carry many of the CVEs. A module you never load cannot hurt you. See loading only the modules you use.
.htaccess authors are a trust boundary. Several 2025–2026 issues let people who can write .htaccess files read files as the server user. On shared hosting this matters a lot. See .htaccess files.

Check which version you run

# Debian, Ubuntu
apache2 -v
dpkg-query -W apache2

# RHEL, AlmaLinux, Rocky, Fedora
httpd -v
rpm -q httpd

# Any system with apachectl in the PATH
apachectl -v

Typical output on Debian 13:

Server version: Apache/2.4.69 (Debian)
Server built:   2026-10-01T16:54:08
apache2	2.4.69-1~deb13u1

The first command shows the upstream version the package is based on. The second shows the full package version, which is what you compare against your distribution's tracker. If you built httpd from source, /usr/local/apache2/bin/httpd -v (or wherever you installed it) is the only check that matters, and you must upgrade to the fixed upstream release yourself.

Distribution backports

Stable distributions often keep one httpd version for the life of a release and backport the security fixes into it. A server that reports Apache/2.4.66 may therefore already be protected against a CVE that upstream fixed in 2.4.67. The reverse also happens: a distribution may not be affected at all, because its older code never had the bug. Only the distribution's own record tells you which case applies.

A real example is CVE-2026-23918, the HTTP/2 double free fixed upstream in 2.4.67:

The Debian security tracker lists it as fixed in 2.4.66-1~deb13u2 for Debian 13 (trixie) and 2.4.67-1~deb12u2 for Debian 12 (bookworm). It lists Debian 11 (bullseye) as not affected.
The Ubuntu CVE page shows Ubuntu 26.04 LTS fixed in 2.4.66-2ubuntu2.1. Older releases are marked not affected, because their mod_http2 lacked the memory-allocator change that turned the bug into a double free.

So "2.4.66" is safe on one system and vulnerable on another. Where to look:

Debian: security-tracker.debian.org/tracker/source-package/apache2 lists every open and fixed CVE per release. In early November 2026 it still showed many of the 2.4.69 CVEs as open for Debian 12 (bookworm), while Debian 13 already had 2.4.69-1~deb13u1.
Ubuntu: ubuntu.com/security/cves. Search for the CVE and read the apache2 row for your release.
Red Hat Enterprise Linux and rebuilds: Red Hat's CVE database. Each CVE page gives Red Hat's own severity and the errata that fix it. AlmaLinux and Rocky Linux follow those errata.

You can also search the package changelog on the server itself:

# Debian, Ubuntu
zgrep -n CVE-2026-23918 /usr/share/doc/apache2/changelog.Debian.gz
apt changelog apache2 | grep -n CVE-2026-23918

# RHEL family, Fedora
rpm -q --changelog httpd | grep -n CVE-2026-23918

No output does not prove you are vulnerable. Some entries wrap across lines, and a release that was never affected will not mention the CVE at all. The tracker is the authority. To install the fix, update the packages and then do a full restart, as described on the Security hub.

Do not mix sources. Do not compile a newer httpd over a distribution package, and do not compare a distribution's version string with the upstream "fixed in" column. Either follow the distribution's updates, or build and track upstream yourself. Doing half of each leaves you guessing.