IBM HTTP Server vulnerabilities

22 CVEs affecting IBM HTTP Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9170, published 2026-05-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-0425, published 2010-03-05. High severity, CVSS 10.0. EPSS: 94.2% chance of exploitation in the next 30 days. modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request…
CVE-2004-0493, published 2004-08-06. Medium severity, CVSS 6.4. EPSS: 84.8% chance of exploitation in the next 30 days. The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based…
CVE-2000-0505, published 2000-05-31. Medium severity, CVSS 5.0. EPSS: 46.7% chance of exploitation in the next 30 days. The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
CVE-2004-0492, published 2004-08-06. High severity, CVSS 10.0. EPSS: 33.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a…
CVE-2015-4947, published 2015-09-15. High severity, CVSS 9.0. EPSS: 7.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, as used in WebSphere…
CVE-2004-1082, published 2004-02-03. High severity, CVSS 7.5. EPSS: 7.6% chance of exploitation in the next 30 days. mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
CVE-2012-5955, published 2012-12-20. High severity, CVSS 10.0. EPSS: 4.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2004-0263, published 2004-11-23. Medium severity, CVSS 5.0. EPSS: 3.9% chance of exploitation in the next 30 days. PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow…
CVE-2001-0122, published 2001-03-13. Medium severity, CVSS 5.0. EPSS: 3.3% chance of exploitation in the next 30 days. Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series…
CVE-2002-1822, published 2002-12-31. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a…

Latest

CVE-2026-9170, published 2026-05-26. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.
CVE-2026-8856, published 2026-05-26. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.
CVE-2026-8855, published 2026-05-26. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).
CVE-2026-8854, published 2026-05-26. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.
CVE-2026-8835, published 2026-05-26. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive…
CVE-2026-8834, published 2026-05-26. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause…
CVE-2026-8852, published 2026-05-26. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.
CVE-2026-8850, published 2026-05-26. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.
CVE-2023-32342, published 2023-05-30. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial…
CVE-2023-26281, published 2023-03-01. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force ID: 248296.