VulnerableCode Package Details - pkg:ebuild/www-servers/apache@2.4.23

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-7zer-dq7c-8ffq	For configurations enabling support for HTTP/2, SSL client certificate validation was not enforced if configured, allowing clients unauthorized access to protected resources over HTTP/2. This issue affected releases 2.4.18 and 2.4.20 only.	CVE-2016-4979
VCID-fnxp-n271-mfd8	A NULL pointer deference was found in mod_cache. A malicious HTTP server could cause a crash in a caching forward proxy configuration. This crash would only be a denial of service if using a threaded MPM.	CVE-2014-3581
VCID-k4kb-21tp-4kc8	An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests. A malicious client could force the server to misinterpret the request length, allowing cache poisoning or credential hijacking if an intermediary proxy is in use.	CVE-2015-3183
VCID-kv7f-t14h-2bfv	By manipulating the flow control windows on streams, a client was able to block server threads for long times, causing starvation of worker threads. Connections could still be opened, but no streams where processed for these. This issue affected HTTP/2 support in 2.4.17 and 2.4.18.	CVE-2016-1546

Vulnerability

Summary

Aliases

VCID-7zer-dq7c-8ffq

For configurations enabling support for HTTP/2, SSL client certificate validation was not enforced if configured, allowing clients unauthorized access to protected resources over HTTP/2. This issue affected releases 2.4.18 and 2.4.20 only.

CVE-2016-4979

VCID-fnxp-n271-mfd8

A NULL pointer deference was found in mod_cache. A malicious HTTP server could cause a crash in a caching forward proxy configuration. This crash would only be a denial of service if using a threaded MPM.

CVE-2014-3581

VCID-k4kb-21tp-4kc8

An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests. A malicious client could force the server to misinterpret the request length, allowing cache poisoning or credential hijacking if an intermediary proxy is in use.

CVE-2015-3183

VCID-kv7f-t14h-2bfv

By manipulating the flow control windows on streams, a client was able to block server threads for long times, causing starvation of worker threads. Connections could still be opened, but no streams where processed for these. This issue affected HTTP/2 support in 2.4.17 and 2.4.18.

CVE-2016-1546

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T13:14:24.726494+00:00	Gentoo Importer	Fixing	VCID-7zer-dq7c-8ffq	https://security.gentoo.org/glsa/201610-02	38.0.0
2026-04-01T13:14:24.711455+00:00	Gentoo Importer	Fixing	VCID-kv7f-t14h-2bfv	https://security.gentoo.org/glsa/201610-02	38.0.0
2026-04-01T13:14:24.696486+00:00	Gentoo Importer	Fixing	VCID-k4kb-21tp-4kc8	https://security.gentoo.org/glsa/201610-02	38.0.0
2026-04-01T13:14:24.681348+00:00	Gentoo Importer	Fixing	VCID-fnxp-n271-mfd8	https://security.gentoo.org/glsa/201610-02	38.0.0