Exposición de Apache HTTP Server

Web servers
561
score de exposición
1.580.941
sitios usan
5
en explotación
20
críticos
Análisis Vexday

O Apache HTTP Server acumula 169 CVEs catalogadas, com 16 classificadas como críticas e 34 surgidas apenas nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige atenção contínua. A taxa de exploração ativa é 6,6 vezes acima da média geral do catálogo CISA KEV, com 5 vulnerabilidades confirmadas em uso por agentes de ameaça — proporção que coloca o servidor entre as tecnologias de maior risco operacional imediato. A CVE mais perigosa atualmente ativa, CVE-2021-40438, apresenta EPSS de 1,0, o valor máximo possível, indicando probabilidade praticamente certa de exploração observada no ambiente real. O tipo de falha mais recorrente é CWE-476 (desreferência de ponteiro nulo), embora o perfil de risco mais crítico esteja nas vulnerabilidades com exploração confirmada, que devem ser priorizadas em qualquer plano de remediação.

CVEs

178 resultados
CVE-2021-2480LOWVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affecteEPSS 0.8%CVE-2025-65082MEDIUMApache HTTP Server: CGI environment variable overrideEPSS 0.8%CVE-2024-43204HIGHApache HTTP Server: SSRF with mod_headers setting Content-Type headerEPSS 0.8%CVE-2019-25352HIGHGenivia Crystal Live HTTP Server 6.01 - 'Crystal Live HTTP Server' Path TraversalEPSS 0.8%CVE-2026-44185HIGHApache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`EPSS 0.7%CVE-2019-5457—Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execuEPSS 0.7%CVE-2026-34356HIGHApache HTTP Server: ProxyPassReverseCookieMap buffer overflowEPSS 0.7%CVE-2025-54090MEDIUMApache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64EPSS 0.7%CVE-2026-29167CRITICALApache HTTP Server: mod_ldap per-dir use-after-freeEPSS 0.7%CVE-2024-42516HIGHApache HTTP Server: HTTP response splittingEPSS 0.7%CVE-2024-47252HIGHApache HTTP Server: mod_ssl error log variable escapingEPSS 0.7%CVE-2026-24072HIGHApache HTTP Server: mod_rewrite elevation of privileges via ap_exprEPSS 0.7%CVE-2022-21593HIGHVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). Supported versions that are affeEPSS 0.6%CVE-2025-66200MEDIUMApache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfoEPSS 0.6%CVE-2026-29168HIGHApache HTTP Server: mod_md unrestricted OCSP responseEPSS 0.6%CVE-2014-125098MEDIUMDart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scriptingEPSS 0.6%CVE-2026-29169HIGHApache HTTP Server: mod_dav_lock indirect lock crashEPSS 0.6%CVE-2026-24469HIGHC++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File ReadEPSS 0.6%CVE-2026-44186HIGHApache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftpEPSS 0.6%CVE-2024-20991MEDIUMVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affecEPSS 0.6%