Oracle HTTP Server
112 CVEs affecting Oracle HTTP Server. Latest disclosed: 2026-07-21. Critical: 18, High: 34.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-60365 | Critical | 10.0 | 2026-07-21 | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Ser… |
CVE-2026-21962 | Critical | 10.0 | 2026-01-20 | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for… |
CVE-2026-60364 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Ser… |
CVE-2026-60363 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2022-23943 | Critical | 9.8 | 2022-03-14 | Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue… |
CVE-2022-22720 | Critical | 9.8 | 2022-03-14 | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Re… |
CVE-2022-25315 | Critical | 9.8 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. |
CVE-2022-25236 | Critical | 9.8 | 2022-02-16 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
CVE-2022-25235 | Critical | 9.8 | 2022-02-16 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain con… |
CVE-2021-44790 | Critical | 9.8 | 2021-12-20 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is… |
CVE-2021-39275 | Critical | 9.8 | 2021-09-16 | ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party… |
CVE-2019-5482 | Critical | 9.8 | 2019-09-16 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. |
CVE-2019-3822 | Critical | 9.8 | 2019-02-06 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth… |
CVE-2026-60438 | Critical | 9.1 | 2026-07-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2020-35169 | Critical | 9.1 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulne… |
CVE-2022-22721 | Critical | 9.1 | 2022-03-14 | If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out o… |
CVE-2019-10082 | Critical | 9.1 | 2019-09-26 | In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection… |
CVE-2021-40438 | Critical | 9.0 | 2021-09-16 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4… |
CVE-2026-34291 | High | 8.7 | 2026-04-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2… |
CVE-2026-60431 | High | 8.6 | 2026-07-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 1… |