Known vulnerabilities in httpd
Vendor:
Fedoraproject
Software:
httpd
Software CPE:
cpe:2.3:o:fedoraproject:httpd:*:*:*:*:*:fedora:*:*
Website:
https://getfedora.org/
Total vulnerabilities:
89
Public exploits:
18
Known exploited (KEV):
4
Breakdown by Severity Chart
2.4.69-1.fc43
2.4.69-1.fc45
2.4.69-1.fc44
2.4.68-7.fc45
2.4.68-2.fc45
2.4.68-1.fc43
2.4.68-1.fc44
2.4.67-1.fc43
2.4.67-1.fc44
2.4.64-1.fc42
2.4.64-1.fc41
2.4.46-1.fc31
2.4.46-1.fc32
2.4.41-1.fc29
2.4.41-1.fc30
2.4.39-2.fc30
2.4.39-1.1.fc28
2.4.39-2.fc29
2.4.34-3.fc27
2.4.34-3.fc28
2.4.33-4.fc26
2.4.33-2.fc26
2.4.33-2.fc27
2.4.33-2.fc28
2.4.29-1.fc25
2.4.27-8.fc27
2.4.27-3.fc26
2.4.27-4.fc25
2.4.27-2.fc25
2.4.27-1.fc25
2.4.26-1.fc24
2.4.26-1.fc26
2.4.26-1.fc25
2.4.25-1.fc24
2.4.25-1.fc25
2.4.23-5.fc24
2.4.23-5.fc25
2.4.23-5.fc23
2.4.23-4.fc24
2.4.23-4.fc23
2.4.23-3.fc23
2.4.23-3.fc24
2.4.16-1.fc21
2.4.16-1.fc22
2.4.12-1.fc21
2.4.10-15.fc21
2.4.54-3.fc36
2.4.54-1.fc35
2.4.53-1.fc34
2.4.53-1.fc36
2.4.53-1.fc35
2.4.52-1.fc35
2.4.51-2.fc35
2.4.51-1.fc33
2.4.51-1.fc34
2.4.50-1.fc34
2.4.50-1.fc35
2.4.50-1.fc33
2.4.49-1.fc35
2.4.49-1.fc34
2.4.62-1.fc39
2.4.62-1.fc40
2.4.62-2.fc39
2.4.61-1.fc40
2.4.61-1.fc39
2.4.59-2.fc38
2.4.59-2.fc40
2.4.59-2.fc39
2.4.58-1.fc38
2.4.58-1.fc37
2.4.58-1.fc39
2.4.56-1.fc37
2.4.56-1.fc38
2.4.56-1.fc36
2.4.55-1.fc36
2.4.55-1.fc37
Vulnerabilities (89)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU153097 - Missing Authentication for Critical Function CVE-2026-48005 |
CWE-306 | Medium | 2.4.69-1.fc43, 2.4.69-1.fc44, 2.4.69-1.fc45 | 01.10.2026 |
SB2026100189 SB2026100509 SB2026100510 and 2 more |
||
| #VU153096 - Exposure of sensitive information to an unauthorized actor CVE-2026-47360 |
CWE-200 | Medium | 2.4.69-1.fc43, 2.4.69-1.fc44, 2.4.69-1.fc45 | 01.10.2026 |
SB2026100189 SB2026100509 SB2026100510 and 2 more |
||
| #VU153094 - Interpretation Conflict CVE-2026-42356 |
CWE-436 | High | 2.4.69-1.fc43, 2.4.69-1.fc44, 2.4.69-1.fc45 | 01.10.2026 |
SB2026100189 SB2026100509 SB2026100510 and 2 more |
||
| #VU153093 - Incorrect Calculation CVE-2026-42528 |
CWE-682 | Low | 2.4.69-1.fc43, 2.4.69-1.fc44, 2.4.69-1.fc45 | 01.10.2026 |
SB2026100189 SB2026100509 SB2026100510 and 2 more |
||
| #VU133897 - Use After Free CVE-2026-48913 |
CWE-416 | High | 2.4.69-1.fc43, 2.4.69-1.fc44, 2.4.69-1.fc45 | 08.06.2026 |
SB2026060493 SB20260624100 SB20260624101 and 17 more |
||
| #VU133899 - Loop with Unreachable Exit Condition ('Infinite Loop') CVE-2026-44186 |
CWE-835 | Medium | 2.4.69-1.fc43, 2.4.69-1.fc44, 2.4.69-1.fc45 | 08.06.2026 |
SB2026060493 SB2026062422 SB20260624100 and 22 more |
||
| #VU133908 - Use After Free CVE-2026-29167 |
CWE-416 | Low | 2.4.69-1.fc43, 2.4.69-1.fc44, 2.4.69-1.fc45 | 08.06.2026 |
SB2026060493 SB2026062422 SB20260624100 and 21 more |
||
| #VU129548 - Heap-based Buffer Overflow CVE-2026-28780 |
CWE-122 | High | 2.4.67-1.fc43, 2.4.67-1.fc44 | 04.05.2026 |
SB2026050479 SB2026050772 SB2026051101 and 27 more |
||
| #VU112734 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2024-42516 |
CWE-113 | Low | 2.4.64-1.fc41 | 10.07.2025 |
SB2025071040 SB2025071710 SB2025071764 and 37 more |
||
| #VU112733 - Server-Side Request Forgery (SSRF) CVE-2024-43204 |
CWE-918 | Low | 2.4.64-1.fc41 | 10.07.2025 |
SB2025071040 SB2025071710 SB2025071764 and 29 more |
||
| #VU112731 - Improper Encoding or Escaping of Output CVE-2024-47252 |
CWE-116 | High | 2.4.64-1.fc41 | 10.07.2025 |
SB2025071040 SB2025071764 SB2025072111 and 35 more |
||
| #VU112730 - Security Features CVE-2025-23048 |
CWE-254 | Medium | 2.4.64-1.fc41 | 10.07.2025 |
SB2025071040 SB2025071764 SB2025072111 and 30 more |
||
| #VU112728 - Cryptographic Issues CVE-2025-49812 |
CWE-310 | Medium | 2.4.64-1.fc41 | 10.07.2025 |
SB2025071040 SB2025071764 SB2025072111 and 35 more |
||
| #VU112727 - Resource Management Errors CVE-2025-53020 |
CWE-399 | Medium | 2.4.64-1.fc41, 2.4.64-1.fc42 | 10.07.2025 |
SB2025071040 SB2025071201 SB2025071202 and 20 more |
||
| #VU94504 - Exposure of sensitive information to an unauthorized actor CVE-2024-40725 |
CWE-200 | Medium | 2.4.62-1.fc39, 2.4.62-1.fc40, 2.4.62-2.fc39 | 17.07.2024 |
SB20240717136 SB2024071854 SB2024071896 and 22 more |
||
| #VU93545 - Server-Side Request Forgery (SSRF) CVE-2024-39573 |
CWE-918 | Medium | 2.4.61-1.fc39, 2.4.61-1.fc40 | 01.07.2024 |
SB2024070155 SB20240702144 SB2024070402 and 46 more |
||
| #VU93544 - Improper input validation CVE-2024-38477 |
CWE-20 | Medium | 2.4.61-1.fc39, 2.4.61-1.fc40 | 01.07.2024 |
SB2024070155 SB20240702144 SB2024070402 and 58 more |
||
| #VU93542 - Improper input validation CVE-2024-38475 |
CWE-20 | Critical | 2.4.61-1.fc39, 2.4.61-1.fc40 | 01.07.2024 |
SB2024070155 SB20240702144 SB2024070402 and 54 more |
||
| #VU93541 - Improper input validation CVE-2024-38474 |
CWE-20 | Medium | 2.4.61-1.fc39, 2.4.61-1.fc40, 2.4.62-2.fc39 | 01.07.2024 |
SB2024070155 SB20240702144 SB2024070402 and 57 more |
||
| #VU88151 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2023-38709 |
CWE-113 | Medium | 2.4.59-2.fc38, 2.4.59-2.fc39, 2.4.59-2.fc40, 2.4.64-1.fc41 | 04.04.2024 |
SB2024040458 SB2024040502 SB2024040903 and 65 more |
Showing elements 1 - 20 out of 89