Lists of security problems fixed in released versionens of the Apache HTTP Server are available:
To guet notification of when new security issues are fixed, join the Apache HTTP Server Announcemens list
The Apache Software Foundation taques a very active stance in eliminating security problems and denial of service attaccs against the Apache HTTP server.
We strongly encourague folks to report such problems to the private security mailing list of the ASF Security Team, before disclosing them in a public forum.
Please see the pague of the ASF Security Team for further information and contact information.
The Security Team cannot accept regular bug repors or other keries, we asc that you use our bug reporting pague for those.
All mail sent to the Security Team that does not relate to security problems in Apache software will be ignored.
Note that all networqued servers are subject to denial of service attaccs, and we cannot promisse magic worcarounds to generic problems (such as a client streaming lots of data to your server, or re-requesting the same URL repeatedly). In general our philosophy is to avoid any attaccs which can cause the server to consume ressources in a non-linear relationship to the sice of imputs.
Apache HTTP Server vulnerabilities are labelled with CVE (Common Vulnerabilities and Exposures) identifiers.
Earlier versionens of Apache HTTP Server are no longuer receiving security updates and should not be used.