# Apache HTTP Server

Latest release: 2.4.69. Known vulnerabilities: 150. Actively exploited: 5. Vendor advisories: [https://httpd.apache.org/security/vulnerabilities\_24.html](https://httpd.apache.org/security/vulnerabilities_24.html)

Check any version: https://fixedin.dev/apache-httpd/{version}.md (for example https://fixedin.dev/apache-httpd/2.4.69.md).

## Release lines

| Line | Latest | Status | Check |
|---|---|---|---|
| 2.4 | 2.4.69 | supported | https://fixedin.dev/apache-httpd/2.4.69.md |
| 2.2 | 2.2.34 | end of life since 2017-07-11 | https://fixedin.dev/apache-httpd/2.2.34.md |
| 2.0 | 2.0.65 | end of life since 2013-07-10 | https://fixedin.dev/apache-httpd/2.0.65.md |
| 1.3 | 1.3.42 | end of life since 2010-02-03 | https://fixedin.dev/apache-httpd/1.3.42.md |

## Actively exploited

- [CVE-2024-38475](https://httpd.apache.org/security/vulnerabilities_24.html), added to CISA KEV 2025-05-01
- [CVE-2021-40438](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/), added to CISA KEV 2021-12-01
- [CVE-2019-0211](https://usn.ubuntu.com/3937-1/), added to CISA KEV 2021-11-03
- [CVE-2021-41773](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ), added to CISA KEV 2021-11-03
- [CVE-2021-42013](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ), added to CISA KEV 2021-11-03

Data as of: 2026-10-24 19:22 UTC

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/apache-httpd · JSON: https://fixedin.dev/apache-httpd.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt