Lists of security problems fixed in released versions of the Apache HTTP Server are available:

• Apache 2.2 Security Vulnerabilities
• Apache 2.0 Security Vulnerabilities
• Apache 1.3 Security Vulnerabilities

To get notification of when new security issues are fixed, join the Apache HTTP Server Announcements list

The Apache Software Foundation takes a very active stance in eliminating security problems and denial of service attacks against the Apache HTTP server.

We strongly encourage folks to report such problems to the private security mailing list of the ASF Security Team, before disclosing them in a public forum.

Please see the page of the ASF Security Team for further information and contact information.

The Security Team cannot accept regular bug reports or other queries, we ask that you use our bug reporting page for those. All mail sent to the Security Team that does not relate to security problems in Apache software will be ignored.

Note that all networked servers are subject to denial of service attacks, and we cannot promise magic workarounds to generic problems (such as a client streaming lots of data to your server, or re-requesting the same URL repeatedly). In general our philosophy is to avoid any attacks which can cause the server to consume resources in a non-linear relationship to the size of inputs.

More security tips

Apache HTTP Server vulnerabilities are labelled with CVE (Common Vulnerabilities and Exposures) identifiers.

Experimental OVAL definitions are available for Apache HTTP Server vulnerabilities