Apache

Apache Traffic Server Internal @Header Metadata Spoofing (CVE-2026-33267) newCVE-2026-33267 / GHSA-jrh6-9hgv-mqm7webCRITICAL 10Patched2026-08-16Apache mod_ssl TLS 1.3 Session Resumption Client Certificate Bypass (CVE-2025-23048) newCVE-2025-23048webCRITICAL 9.1Patched2026-07-06Apache HTTP Server mod_auth_digest Timing Attack — CVE-2026-33006 newCVE-2026-33006webMEDIUM 4.8Patched2026-07-05Apache HTTP Server HTTP/2 HPACK Cookie-Merging Memory Bomb (CVE-2026-49975) new EPSS 31%CVE-2026-49975networkHIGHUnverified2026-07-05Apache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918 new EPSS 50%CVE-2026-23918webCRITICALPatched2026-05-17