BSD PortsApache httpd -- Multiple vulnerabilities
· CVE-2024-42516, CVE-2024-43204, CVE-2024-43394, CVE-2024-47252, CVE-2025-23048, CVE-2025-49630, CVE-2025-49812, CVE-2025-53020 · VuXML entry
The Apache httpd project reports: moderate: Apache HTTP Server: HTTP response splitting (CVE-2024-42516) low: Apache HTTP Server: SSRF with mod_headers setting Content-Type header (CVE-2024-43204) moderate: Apache HTTP Server: SSRF on Windows due to UNC paths (CVE-2024-43394) low: Apache HTTP Server: mod_ssl error log variable escaping (CVE-2024-47252) moderate: Apache HTTP Server: mod_ssl access control bypass with …
Affected versions
- apache24 < 2.4.64
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | www/apache24 | 2.4.63 | vulnerable since 2025-07-11 | |
| NetBSD | www/apache24 | 2.4.69 | not listed | |
| MidnightBSD | www/apache24 | 2.4.69 | out of range, by version | |
| FreeBSD | www/apache24 | 2.4.69 | fixed | (447 days after) |