VulertSecurity VulertSecurity

Vulnerability Database · Alpine · apache2 · Version

apache2 2.4.48-r0

2.4.48-r0 is affected by 42 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 5 High 24 Medium 11 Low 1 Unrated 1

All apache2 versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache2 2.4.48-r0 vulnerabilities

42 vulnerabilities cover apache2 2.4.48-r0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Critical Improper Privilege Management in Apache HTTP Server's mod_ssl 9.8 critical 2.4.69-r0 01 Oct 2026
Critical Use After Free Vulnerability in Apache HTTP Server (mod_http2) 9.8 critical 2.4.69-r0 01 Oct 2026
Critical Use After Free Vulnerability in Apache HTTP Server's mod_rewrite 9.8 critical 2.4.69-r0 01 Oct 2026
Critical Buffer Underwrite Vulnerability in Apache HTTP Server (CVE-2026-44631) 9.8 critical 2.4.68-r0 08 Jun 2026
Critical Path Handling Vulnerability in Apache2 - CVE-2026-42535 9.1 critical 2.4.68-r0 08 Jun 2026
Critical Integer Overflow Vulnerability in Apache HTTP Server (apache2) - CVE-2026-93546 8.8 high 2.4.69-r0 01 Oct 2026
Critical Double Free Vulnerability in Apache HTTP Server (CVE-2026-23918) 8.8 high 2.4.67-r0 04 May 2026
Privilege Escalation Vulnerability in Apache HTTP 2.4.66 and Earlier 8.8 high 2.4.67-r0 04 May 2026
Critical Authentication Bypass in Apache HTTP Server 2.4.x 8.1 high 2.4.69-r0 01 Oct 2026
HTTP Request Smuggling Vulnerability in Apache HTTP Server (CVE-2026-63718) 7.5 high 2.4.69-r0 01 Oct 2026
NULL Pointer Dereference Vulnerability in Apache HTTP Server (apache2) - Denial of Service Risk 7.5 high 2.4.69-r0 01 Oct 2026
Critical Stack-Based Buffer Overflow in Apache HTTP Server (apache2) - CVE-2026-63292 7.5 high 2.4.69-r0 01 Oct 2026
Critical Vulnerability in Apache HTTP Server (apache2): Improper FTP PASV Reply Validation 7.5 high 2.4.69-r0 01 Oct 2026
Critical Out-of-Bounds Write Vulnerability in Apache HTTP Server (CVE-2026-59685) 7.5 high 2.4.69-r0 01 Oct 2026
Out-of-Bounds Write Vulnerability in Apache HTTP Server's mod_proxy_html 7.5 high 2.4.69-r0 01 Oct 2026
Critical Out-of-Bounds Write Vulnerability in Apache HTTP Server's mod_charset_lite 7.5 high 2.4.69-r0 01 Oct 2026
Critical Denial of Service Vulnerability in Apache HTTP Server - CVE-2026-48005 7.5 high 2.4.69-r0 01 Oct 2026
Sensitive Information Exposure in Apache HTTP Server's mod_session_cookie Module 7.5 high 2.4.69-r0 01 Oct 2026
NULL Pointer Dereference Vulnerability in Apache HTTP Server (mod_heartmonitor) 7.5 high 2.4.69-r0 01 Oct 2026
Heap-based Buffer Overflow in Apache HTTP Server (mod_xml2enc) - CVE-2026-42536 7.5 high 2.4.68-r0 08 Jun 2026
Buffer Overflow Vulnerability in Apache HTTP Server 2.4.67 and Earlier 7.5 high 2.4.68-r0 08 Jun 2026
Heap-based Buffer Overflow in Apache HTTP Server (CVE-2026-34356) 7.5 high 2.4.68-r0 08 Jun 2026
Critical NULL Pointer Dereference in Apache HTTP Server 2.4.66 and Earlier 7.5 high 2.4.67-r0 04 May 2026
Critical Buffer Over-read Vulnerability in Apache HTTP Server (CVE-2026-34059) 7.5 high 2.4.67-r0 04 May 2026
Critical Use After Free Vulnerability in Apache HTTP Server (apache2) - CVE-2026-73637 7.3 high 2.4.69-r0 01 Oct 2026
Critical Use After Free Vulnerability in Apache HTTP Server (mod_http2) 7.3 high 2.4.68-r0 08 Jun 2026
Infinite Loop Vulnerability in Apache HTTP Server's mod_proxy_ftp Module 7.3 high 2.4.68-r0 08 Jun 2026
Buffer Over-read Vulnerability in Apache HTTP Server (CVE-2026-44185) 7.3 high 2.4.68-r0 08 Jun 2026
Resource Allocation Vulnerability in Apache HTTP Server's mod_md - CVE-2026-29168 7.3 high 2.4.67-r0 05 May 2026
Out-of-Bounds Read Vulnerability in Apache HTTP Server (apache2) - CVE-2026-43951 6.5 medium 2.4.68-r0 08 Jun 2026
HTTP Response Splitting Vulnerability in Apache HTTP Server (Versions 2.4.66 and Below) 6.5 medium 2.4.67-r0 04 May 2026
Cross-Site Scripting Vulnerability in Apache HTTP Server 2.4.67 and Earlier 6.1 medium 2.4.68-r0 08 Jun 2026
Improper Privilege Management in Apache HTTP Server 2.4.67 and Earlier 5.5 medium 2.4.68-r0 08 Jun 2026
Path Equivalence Vulnerability in Apache HTTP Server's mod_userdir Module 5.3 medium 2.4.69-r0 01 Oct 2026
Apache HTTP Server Vulnerability: Internal State File Exposure in mod_dav_fs 5.3 medium 2.4.69-r0 01 Oct 2026
NULL Pointer Dereference in Apache HTTP Server 2.4.66 and Earlier 5.3 medium 2.4.67-r0 04 May 2026
Apache HTTP Server Improper Null Termination Vulnerability - CVE-2026-34032 5.3 medium 2.4.67-r0 04 May 2026
Out-of-Bounds Read Vulnerability in Apache HTTP Server (apache2) 5.3 medium 2.4.67-r0 04 May 2026
Timing Attack Vulnerability in Apache HTTP Server 2.4.66 - Digest Authentication Bypass 4.8 medium 2.4.67-r0 04 May 2026
Memory Calculation Bug in Apache httpd 2.4.67 and Earlier: WebDAV Lock Vulnerability 4.3 medium 2.4.69-r0 01 Oct 2026
Apache HTTP Server CGI Handler Vulnerability in apache2 Package 3.7 low 2.4.69-r0 01 Oct 2026
Heap-based Buffer Overflow in Apache HTTP Server's mod_proxy_ajp N/A unrated 2.4.67-r0 05 May 2026

Looking for another version, or everything Vulert holds for apache2?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache2 2.4.48-r0

Is apache2 2.4.48-r0 vulnerable?

Yes. 42 vulnerabilities in the Vulert database cover apache2 2.4.48-r0: 5 critical, 24 high, 11 medium and 1 low, plus 1 not yet rated. Each entry above names the fixed version to move to.

How do I monitor apache2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.