Apache HTTP Server on Linux: which version fixes what

What it is, and why it is on your server

The Apache HTTP Server, packaged as apache2 on Debian and Ubuntu and httpd on Rocky and AlmaLinux, is still the web server behind an enormous number of hosting panels, and it is what cPanel and Plesk configure by default.

Why its advisories behave the way they do

• Most Apache advisories are module-specific. mod_proxy, mod_rewrite and mod_http2 account for a large share of them, and if the module is not enabled the advisory does not apply to you. Knowing which are loaded is the difference between a real finding and noise.
• Two names, two lives. The same CVE arrives as apache2 on Debian and httpd on Rocky, on different dates, with completely different version strings. Searching one name finds half the picture.
• Hosting panels re-enable things. A panel that rewrites the configuration on update can quietly switch a module back on, which is why a server can become exposed to an old advisory without anybody installing anything.

Check what you are actually running

The version that matters is the package version, not the upstream one. Distributions backport security fixes without changing the number before the dash, so a release that looks years old is frequently fully patched, and the revision after the dash is the only part that tells you.

dpkg-query -W -f='${Package} ${Version}\n' apache2 apache2-bin 2>/dev/null

rpm -q httpd httpd-core

Run `apache2ctl -M` on Debian and Ubuntu, or `httpd -M` on Rocky and AlmaLinux, to list the modules actually loaded.

Fixed versions, per distribution

Each distribution patches on its own schedule and under its own version scheme, so the same CVE has a different answer on each of them. These come from the distributions’ own advisory data, asked per release. Where a release has no fixed version, that is what the advisory says, not a gap in the data.

Advisory data last refreshed 26 September 2026. It is re-read daily.

What this page does not tell you

It does not tell you whether your server is affected. A CVE applying to a package is not the same as a CVE applying to your installation: the fix may already be backported into what you are running, the vulnerable module may not be loaded, or the service may not be reachable from anywhere that matters. Answering that needs the versions on your machine, not a list.

It also carries no count of how many servers are affected. SecAI monitors a small fleet, and a percentage drawn from it would be arithmetic on a sample too small to mean anything. When that changes, the number will appear here and the page will say when it started.

Read next