Summary
Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module
incorrectly calculated memory sizes when handling WebDAV locks. An attacker
with permission to create WebDAV locks could possibly use this issue to
cause Apache HTTP Server to crash, resulting in a denial of service.
(CVE-2026-42528)
It was discovered that Apache HTTP Server's mod_vhost_alias module
incorrectly handled certain requests, leading to a one-byte stack buffer
overflow. A remote attacker could possibly use this issue to cause Apache
HTTP Server to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-109163)
It was discovered that Apache HTTP Server's mod_md module incorrectly
handled certain conditions, leading to a NULL pointer dereference. An
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu
26.10. (CVE-2026-106023)
It was discovered that Apache HTTP Server's mod_http2 module incorrectly
handled certain request headers, leading to heap corruption. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119618)
Feliks Penconek, Yang Song, and JiaSheng He discovered that Apache HTTP
Server could treat the target of some internal redirects from CGI programs
as a CGI program. A remote attacker could possibly use this issue to
execute arbitrary code. This issue only affected Ubuntu 26.04 LTS and
Ubuntu 26.10. (CVE-2026-42356)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | apache2 | 2.4.52-1ubuntu4.27 |
| Ubuntu · 24.04 LTS 24.04:LTS | apache2 | 2.4.58-1ubuntu8.19 |
| Ubuntu · 26.04 LTS 26.04:LTS | apache2 | 2.4.66-2ubuntu2.8 |
| Ubuntu · 26.10 | apache2 | 2.4.68-1ubuntu6.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | apache2 | 2.4.7-1ubuntu4.22+esm19 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | apache2 | 2.4.18-2ubuntu3.17+esm24 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | apache2 | 2.4.29-1ubuntu4.27+esm15 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | apache2 | 2.4.41-4ubuntu3.23+esm11 |
Vulnerabilities 5
-
High 8.1CVE-2026-119618 Public exploit
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…
-
Medium 4.3
Apache HTTP Server: mod_dav shared lock overflow
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
-
Low 3.7
Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension unders…
-
Unscored —
Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash
NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.
-
Unscored —
Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.