Apache maintains a list of vulnerabilities by version: https://httpd.apache.org/security/
While this specific CVE was patched shortly after the release of 2.4.18 (in version 2.4.20), it serves as a case study in the fragility of module interaction. For administrators who deployed 2.4.18 and did not immediately upgrade, this presented a clear and present danger: an attacker could script a series of malformed requests to CGI endpoints, slowly degrading server performance until the httpd service became unresponsive to legitimate traffic. apache httpd 2.4.18 vulnerability
If you see 2.4.18 , treat it as a in any audit. Apache maintains a list of vulnerabilities by version: