Exposição de Apache HTTP Server

Web servers
633
score de exposição
1.465.263
sites usam
6
em exploração
24
críticos
Análise Vexday

O Apache HTTP Server acumula 169 CVEs catalogadas, com 16 classificadas como críticas e 34 surgidas apenas nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige atenção contínua. A taxa de exploração ativa é 6,6 vezes acima da média geral do catálogo CISA KEV, com 5 vulnerabilidades confirmadas em uso por agentes de ameaça — proporção que coloca o servidor entre as tecnologias de maior risco operacional imediato. A CVE mais perigosa atualmente ativa, CVE-2021-40438, apresenta EPSS de 1,0, o valor máximo possível, indicando probabilidade praticamente certa de exploração observada no ambiente real. O tipo de falha mais recorrente é CWE-476 (desreferência de ponteiro nulo), embora o perfil de risco mais crítico esteja nas vulnerabilidades com exploração confirmada, que devem ser priorizadas em qualquer plano de remediação.

CVEs

204 resultados
CVE-2024-39884MEDIUMApache HTTP Server: source code disclosure with handlers configured via AddTypeEPSS 0.9%CVE-2019-25352HIGHGenivia Crystal Live HTTP Server 6.01 - 'Crystal Live HTTP Server' Path TraversalEPSS 0.9%CVE-2025-59775HIGHApache HTTP Server: NTLM Leakage on Windows through UNC SSRFEPSS 0.9%CVE-2025-54090MEDIUMApache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64EPSS 0.9%CVE-2025-65082MEDIUMApache HTTP Server: CGI environment variable overrideEPSS 0.9%CVE-2021-2480LOWVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affecteEPSS 0.8%CVE-2022-21593HIGHVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). Supported versions that are affeEPSS 0.8%CVE-2024-42516HIGHApache HTTP Server: HTTP response splittingEPSS 0.8%CVE-2024-47252HIGHApache HTTP Server: mod_ssl error log variable escapingEPSS 0.8%CVE-2026-16756HIGHAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceEPSS 0.8%CVE-2026-44185HIGHApache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`EPSS 0.7%CVE-2019-5457—Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execuEPSS 0.7%CVE-2026-34356HIGHApache HTTP Server: ProxyPassReverseCookieMap buffer overflowEPSS 0.7%CVE-2025-66200MEDIUMApache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfoEPSS 0.7%CVE-2026-29167CRITICALApache HTTP Server: mod_ldap per-dir use-after-freeEPSS 0.7%CVE-2026-24072HIGHApache HTTP Server: mod_rewrite elevation of privileges via ap_exprEPSS 0.7%CVE-2026-24469HIGHC++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File ReadEPSS 0.6%CVE-2026-29168HIGHApache HTTP Server: mod_md unrestricted OCSP responseEPSS 0.6%CVE-2014-125098MEDIUMDart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scriptingEPSS 0.6%CVE-2025-49812HIGHApache HTTP Server: mod_ssl TLS upgrade attackEPSS 0.6%