Skip to content

PatchFirst · Latest vulnerabilities

apache httpd 2.4.66: known vulnerabilities · Page 3

Known vulnerabilities affecting apache httpd 2.4.66: 43. Compare the fixes below with your installed release.

RSS ↗ JSON ↗

Vulnerabilities: 43

CVE-2026-34032
Medium · CVSS 5.3EPSS 0.48%No fix published
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
apache httpd Web servers
Published May 4, 2026Updated May 4, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-34059
High · CVSS 7.5EPSS 0.39%No fix published
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
apache httpd Web servers
Published May 4, 2026Updated May 4, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-24072
High · CVSS 8.8EPSS 0.65%No fix published
Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
apache httpd Web servers
Published May 4, 2026Updated May 5, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →