Web servers stack vulnerabilities · Page 6

NGINX ngx_http_rewrite_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomiza

• Update to 1.10.3-0ubuntu0.16.04.5+esm7
• Update to 1.14.0-0ubuntu1.11+esm2
• Update to 1.18.0-0ubuntu1.7+esm1
• Update to 1.18.0-6ubuntu14.11
• Update to 1.22.1-9+deb12u7
• Update to 1.24.0-2ubuntu7.8
• Update to 1.26.3-3+deb13u5
• Update to 1.28.0-6ubuntu1.3
• Update to 1.28.3-2ubuntu1.1
• Update to 1.30.0-3
• Update to 1.30.1
• Update to 1.4.6-1ubuntu3.9+esm6

NGINX ngx_http_ssl_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• Update to 1.10.3-0ubuntu0.16.04.5+esm7
• Update to 1.14.0-0ubuntu1.11+esm2
• Update to 1.18.0-0ubuntu1.7+esm1
• Update to 1.18.0-6ubuntu14.12
• Update to 1.22.1-9+deb12u7
• Update to 1.24.0-2ubuntu7.9
• Update to 1.26.3-3+deb13u5
• Update to 1.28.0-6ubuntu1.4
• Update to 1.28.3-2ubuntu1.2
• Update to 1.30.0-4
• Update to 1.30.1
• Update to 1.4.6-1ubuntu3.9+esm6

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• Update to 2.4.18-2ubuntu3.17+esm18
• Update to 2.4.29-1ubuntu4.27+esm9
• Update to 2.4.41-4ubuntu3.23+esm4
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm13

Apache HTTP Server: mod_md unrestricted OCSP response

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2

Apache HTTP Server: mod_dav_lock indirect lock crash

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.

• Update to 2.4.18-2ubuntu3.17+esm18
• Update to 2.4.29-1ubuntu4.27+esm9
• Update to 2.4.41-4ubuntu3.23+esm4
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm13

Apache HTTP Server: http2: double free and possible RCE on early reset

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• Update to 2.4.66-1~deb13u2
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.66-5
• Update to 2.4.67-1~deb12u2

Apache HTTP Server: mod_auth_digest timing attack

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

• Update to 2.4.18-2ubuntu3.17+esm20
• Update to 2.4.29-1ubuntu4.27+esm11
• Update to 2.4.41-4ubuntu3.23+esm6
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm15

Apache HTTP Server: mod_authn_socache crash

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

• Update to 2.4.18-2ubuntu3.17+esm19
• Update to 2.4.29-1ubuntu4.27+esm10
• Update to 2.4.41-4ubuntu3.23+esm5
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm14

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• Update to 2.4.18-2ubuntu3.17+esm19
• Update to 2.4.29-1ubuntu4.27+esm10
• Update to 2.4.41-4ubuntu3.23+esm5
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm14

Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• Update to 2.4.18-2ubuntu3.17+esm19
• Update to 2.4.29-1ubuntu4.27+esm10
• Update to 2.4.41-4ubuntu3.23+esm5
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm14

Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• Update to 2.4.18-2ubuntu3.17+esm19
• Update to 2.4.29-1ubuntu4.27+esm10
• Update to 2.4.41-4ubuntu3.23+esm5
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm14

Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• Update to 2.4.18-2ubuntu3.17+esm18
• Update to 2.4.29-1ubuntu4.27+esm9
• Update to 2.4.41-4ubuntu3.23+esm4
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm13

Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

• Update to 2.4.18-2ubuntu3.17+esm18
• Update to 2.4.29-1ubuntu4.27+esm9
• Update to 2.4.41-4ubuntu3.23+esm4
• Update to 2.4.52-1ubuntu4.20
• Update to 2.4.58-1ubuntu8.12
• Update to 2.4.64-1ubuntu3.4
• Update to 2.4.66-2ubuntu2.1
• Update to 2.4.67-1
• Update to 2.4.67-1~deb12u2
• Update to 2.4.67-1~deb13u2
• Update to 2.4.7-1ubuntu4.22+esm13

Traefik: BasicAuth middleware: timing side-channel vulnerability

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. Thi

Traefik: StripPrefixRegex auth bypass via Path/RawPath desync

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the prote

Traefik: Forwarded alias spoofing top pre-auth decision bypass

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust

Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects f

CVE-2026-33555

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

• Update to 2.6.12-1+deb12u4
• Update to 2.8.16-0ubuntu0.24.04.2
• Update to 3.0.11-1+deb13u3
• Update to 3.0.12-0ubuntu0.25.10.4
• Update to 3.2.15-1
• Update to 3.2.9-1ubuntu2.1
• Update to 3.3.6

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.