The Apache HTTP Server Project - AskApache Blog




Get Involved



Security Updates

Lists of security problems fixed in released versions of the Apache HTTP Server are available:

To get notification of when new security issues are fixed, join the Apache Server Announcements list

Reporting New Security Problems with Apache

The Apache Software Foundation takes a very active stance in eliminating security problems and denial of service attacks against the Apache web server.

We strongly encourage folks to report such problems to our private security mailing list first, before disclosing them in a public forum.

We cannot accept regular bug reports or other queries at this address, we ask that you use our bug reporting page for those. All mail sent to this address that does not relate to security problems in the Apache source code will be ignored.

The mailing address is:

Note that all networked servers are subject to denial of service attacks, and we cannot promise magic workarounds to generic problems (such as a client streaming lots of data to your server, or re-requesting the same URL repeatedly). In general our philosophy is to avoid any attacks which can cause the server to consume resources in a non-linear relationship to the size of inputs.

More security tips

Security Standards

Apache HTTP Server vulnerabilities are labelled with CVE (Common Vulnerabilities and Exposures) identifiers.

Experimental OVAL definitions are available for Apache HTTP Server vulnerabilities

Copyright © 1999-2005, The Apache Software Foundation