| CVE-2021-40438US | critical9.0OT critical | 100.0% (100th) | KEV | ✗no fix | 2021-09-16 | ≤ Apache HTTP Server 2.4 ≤2.4.48 |
| CVE-2021-41773US | critical9.8OT critical | 100.0% (100th) | KEV | ✗no fix | 2021-10-05 | ≤ Apache HTTP Server 2.4 2.4.49 |
| CVE-2021-42013US | critical9.8OT critical | 100.0% (100th) | KEV | ✗no fix | 2021-10-07 | 2 versions |
| CVE-2024-38475US | critical9.1OT critical | 100.0% (100th) | KEV | ✗no fix | 2024-07-01 | ≤ 2.4.0 ≤2.4.59 |
| CVE-2021-44790US | critical9.8 | 96.8% (100th) | Exploit | ✗no fix | 2021-12-20 | ≤ Apache HTTP Server 2.4 ≤2.4.51 |
| CVE-2017-9798US | high7.5 | 95.0% (100th) | Exploit | ✗no fix | 2017-09-18 | ≤ Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27 |
| CVE-2024-27316US | high7.5 | 91.3% (100th) | Exploit | ✗no fix | 2024-04-04 | ≤ 2.4.17 ≤2.4.58 |
| CVE-2017-15715US | high8.1 | 85.5% (100th) | Exploit | ✗no fix | 2018-03-26 | ≤ 2.4.0 to 2.4.29 |
| CVE-2023-25690US | critical9.8 | 84.5% (100th) | Exploit | ✗no fix | 2023-03-07 | ≤ 2.4.0 ≤2.4.55 |
| CVE-2016-8740US | high7.5 | 79.1% (100th) | Exploit | ✗no fix | 2016-12-05 | ≤ 2.4.17 - 2.4.23 |
| CVE-2024-38472US | — | 69.5% (99th) | Exploit | ✗no fix | 2024-07-01 | ≤ 2.4.0 ≤2.4.59 |
| CVE-2023-43622US | high7.5 | 68.8% (99th) | Exploit | ✗no fix | 2023-10-23 | ≤ 2.4.55 ≤2.4.57 |
| CVE-2021-26690US | high7.5 | 65.3% (99th) | Exploit | ✗no fix | 2021-06-10 | 29 versions |
| CVE-2026-23918US | — | 49.7% (99th) | Exploit | ✗no fix | 2026-05-04 | 2 versions |
| CVE-2016-0736US | high7.5 | 49.0% (99th) | Exploit | ✗no fix | 2017-07-27 | ≤ 2.4.0 to 2.4.23 |
| CVE-2024-38476US | critical9.8 | 41.6% (99th) | Exploit | ✗no fix | 2024-07-01 | ≤ 2.4.0 ≤2.4.59 |
| CVE-2017-7679US | critical9.8 | 39.3% (99th) | Exploit | ✗no fix | 2017-06-20 | 2 versions |
| CVE-2026-49975US | — | 33.0% (98th) | Exploit | ✗no fix | 2026-06-08 | ≤ 2.4.17 ≤2.4.67 |
| CVE-2022-22720US | critical9.8 | 28.2% (98th) | Exploit | ✗no fix | 2022-03-14 | ≤ Apache HTTP Server 2.4 ≤2.4.52 |
| CVE-2024-38473US | — | 25.9% (98th) | Exploit | ✗no fix | 2024-07-01 | ≤ 2.4.0 ≤2.4.59 |
| CVE-2022-26377US | high7.5 | 21.1% (98th) | Exploit | ✗no fix | 2022-06-09 | ≤ Apache HTTP Server 2.4 ≤2.4.53 |
| CVE-2025-53020US | — | 4.96% (92nd) | Exploit | ✗no fix | 2025-07-10 | ≤ 2.4.17 ≤2.4.63 |
| CVE-2024-40725US | medium5.3 | 4.42% (91st) | Exploit | ✗no fix | 2024-07-18 | ≤ 2.4.60 ≤2.4.61 |
| CVE-2023-38709US | — | 3.91% (90th) | Exploit | ✗no fix | 2024-04-04 | ≤ 0 ≤2.4.58 |
| CVE-2006-20001US | high7.5 | 3.55% (89th) | Exploit | ✗no fix | 2023-01-17 | ≤ 2.4 ≤2.4.54 |
| CVE-2022-31813US | critical9.8OT high | 3.54% (89th) | Exploit | ✗no fix | 2022-06-09 | ≤ Apache HTTP Server 2.4 ≤2.4.53 |
| CVE-2023-45802US | medium5.9 | 3.17% (88th) | Exploit | ✗no fix | 2023-10-23 | ≤ 2.4.17 ≤2.4.57 |
| CVE-2024-40898US | high7.5 | 1.63% (76th) | Exploit | ✗no fix | 2024-07-18 | ≤ 2.4.0 ≤2.4.61 |
| CVE-2025-58098US | — | 1.42% (73rd) | Exploit | ✓2.4.66 | 2025-12-05 | 0 → 2.4.66 |
| CVE-2025-23048US | — | 1.04% (64th) | Exploit | ✗no fix | 2025-07-10 | ≤ 2.4.35 ≤2.4.63 |
| CVE-2026-42536US | — | 1.02% (63rd) | Exploit | ✗no fix | 2026-06-08 | ≤ 2.4.0 ≤2.4.67 |
| CVE-2026-24072US | — | 0.65% (51st) | Exploit | ✗no fix | 2026-05-04 | 2 versions |
| CVE-2025-49812US | — | 0.61% (49th) | Exploit | ✗no fix | 2025-07-10 | ≤ 0 ≤2.4.63 |
| CVE-2026-33006US | — | 0.56% (46th) | Exploit | ✗no fix | 2026-05-04 | 2 versions |
| CVE-2022-30522US | high7.5 | 89.5% (100th) | — | ✗no fix | 2022-06-09 | ≤ 2.4.53 |
| CVE-2021-44224US | high8.2 | 82.3% (100th) | — | ✓Apache HTTP Server 2.4* | 2021-12-20 | 2.4.7 → Apache HTTP Server 2.4* |
| CVE-2018-1303US | high7.5 | 69.8% (99th) | — | ✗no fix | 2018-03-26 | ≤ 2.4.5 to 2.4.29 |
| CVE-2022-22719US | high7.5 | 69.1% (99th) | — | ✗no fix | 2022-03-14 | ≤ Apache HTTP Server 2.4 ≤2.4.52 |
| CVE-2021-26691US | critical9.8 | 68.3% (99th) | — | ✗no fix | 2021-06-10 | 29 versions |
| CVE-2021-34798US | high7.5 | 64.5% (99th) | — | ✗no fix | 2021-09-16 | ≤ Apache HTTP Server 2.4 ≤2.4.48 |
| CVE-2021-36160US | high7.5 | 62.9% (99th) | — | ✗no fix | 2021-09-16 | ≤ Apache HTTP Server 2.4 ≤2.4.48 |
| CVE-2019-17567US | medium5.3 | 60.3% (99th) | — | ✗no fix | 2021-06-10 | 24 versions |
| CVE-2019-0190US | high7.5 | 59.1% (99th) | — | ✗no fix | 2019-01-30 | ≤ Apache HTTP Server 2.4.37 |
| CVE-2017-7668US | high7.5 | 57.5% (99th) | — | ✗no fix | 2017-06-20 | 2 versions |
| CVE-2017-9788US | critical9.1 | 56.8% (99th) | — | ✗no fix | 2017-07-13 | 2 versions |
| CVE-2022-37436US | medium5.3 | 55.9% (99th) | — | ✓2.4.55 | 2023-01-17 | 0 → 2.4.55 |
| CVE-2018-8011US | high7.5 | 55.6% (99th) | — | ✗no fix | 2018-07-18 | ≤ Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33) |
| CVE-2020-35452US | high7.3 | 54.8% (99th) | — | ✗no fix | 2021-06-10 | 29 versions |
| CVE-2017-7659US | high7.5 | 53.9% (99th) | — | ✗no fix | 2017-07-26 | ≤ 2.4.24, 2.4.25 |
| CVE-2021-30641US | medium5.3 | 52.6% (99th) | — | ✗no fix | 2021-06-10 | 4 versions |