IBM HTTP Server

Name: IBM HTTP Server
Brand: IBM

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical4high4medium0low

updated 2026-10-27

vulnerabilities (38)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-49975US	—	33.0% (98th)	Exploit	8.5.5.30	2026-06-08	2 versions
CVE-2025-53020US	—	4.96% (92nd)	Exploit	9.0.5.25	2025-07-10	2 versions
CVE-2023-38709US	—	3.91% (90th)	Exploit	9.0.5.25	2024-04-04	2 versions
CVE-2023-45802US	medium5.9	3.17% (88th)	Exploit	9.0.5.18	2023-10-23	< 9.0.5.18
CVE-2025-23048US	—	1.04% (64th)	Exploit	9.0.5.25	2025-07-10	2 versions
CVE-2026-42536US	—	1.02% (63rd)	Exploit	9.0.5.29	2026-06-08	2 versions
CVE-2025-49812US	—	0.61% (49th)	Exploit	8.5.5.29	2025-07-10	2 versions
CVE-2023-31122US	high7.5	3.04% (87th)	—	9.0.5.18	2023-10-23	< 9.0.5.18
CVE-2024-24795US	—	2.87% (87th)	—	8.5.5.29	2024-04-04	2 versions
CVE-2025-49630US	—	1.35% (71st)	—	8.5.5.29	2025-07-10	2 versions
CVE-2024-43394US	—	1.27% (70th)	—	8.5.5.29	2025-07-10	2 versions
CVE-2026-34355US	—	1.16% (67th)	—	9.0.5.29	2026-06-08	2 versions
CVE-2023-26281US	high7.5	1.12% (66th)	—	no fix	2023-03-01	≤ 8.5
CVE-2024-43204US	—	0.91% (60th)	—	8.5.5.29	2025-07-10	2 versions
CVE-2025-54090US	—	0.88% (59th)	—	9.0.5.25	2025-07-23	< 9.0.5.25
CVE-2024-42516US	—	0.82% (57th)	—	8.5.5.29	2025-07-10	2 versions
CVE-2024-47252US	—	0.80% (56th)	—	8.5.5.29	2025-07-10	2 versions
CVE-2026-44185US	—	0.74% (54th)	—	9.0.5.29	2026-06-08	2 versions
CVE-2026-34356US	—	0.71% (53rd)	—	8.5.5.30	2026-06-08	2 versions
CVE-2026-29167US	—	0.69% (53rd)	—	9.0.5.29	2026-06-08	2 versions
CVE-2026-44186US	—	0.58% (48th)	—	8.5.5.30	2026-06-08	2 versions
CVE-2026-43951US	—	0.55% (46th)	—	9.0.5.29	2026-06-08	2 versions
CVE-2026-42535US	—	0.54% (45th)	—	8.5.5.30	2026-06-08	2 versions
CVE-2026-29170US	—	0.52% (44th)	—	8.5.5.30	2026-06-08	2 versions
CVE-2026-44631US	—	0.50% (43rd)	—	8.5.5.30	2026-06-08	2 versions
CVE-2026-9170US	—	0.49% (42nd)	—	9.0.5.29	2026-05-26	6 versions
CVE-2026-48913US	—	0.48% (41st)	—	9.0.5.29	2026-06-08	2 versions
CVE-2026-8855US	critical9.8	0.46% (39th)	—	8.5.5.30	2026-05-26	6 versions
CVE-2026-8850US	—	0.38% (32nd)	—	8.5.5.30	2026-05-26	6 versions
CVE-2026-8854US	—	0.36% (30th)	—	9.0.5.29	2026-05-26	6 versions
CVE-2026-8834US	—	0.26% (18th)	—	9.0.5.29	2026-05-26	6 versions
CVE-2026-8835US	high7.3	0.25% (17th)	—	9.0.5.29	2026-05-26	6 versions
CVE-2026-32777US	medium5.5	0.22% (12th)	—	9.0.5.28	2026-03-16	2 versions
CVE-2026-8856US	critical9.1	0.20% (9th)	—	8.5.5.29 PH71265	2026-05-26	6 versions
CVE-2026-8852US	high7.5	0.20% (9th)	—	9.0.5.29	2026-05-26	6 versions
CVE-2026-44119US	—	0.18% (7th)	—	9.0.5.29	2026-06-08	2 versions
CVE-2026-32778US	medium5.5	0.17% (7th)	—	9.0.5.28	2026-03-16	2 versions
CVE-2026-32776US	medium5.5	0.17% (6th)	—	8.5.5.30	2026-03-16	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-122Heap-based Buffer Overflow4 CVEs
CWE-20Improper Input Validation4 CVEs
CWE-125Out-of-bounds Read3 CVEs
CWE-476NULL Pointer Dereference3 CVEs
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')2 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')2 CVEs
CWE-400Uncontrolled Resource Consumption2 CVEs
CWE-416Use After Free2 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)37 CVEs
EUEU Vulnerability Database (ENISA)9 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan