Apache HTTP Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• Critical 9.8
  CVE-2026-28780

  Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

  Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  May 5, 2026
• High 8.8
  CVE-2026-23918 Public exploit EPSS 50%

  Apache HTTP Server: http2: double free and possible RCE on early reset

  Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 8.8
  CVE-2026-24072 Public exploit

  Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

  An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.5
  CVE-2026-29169

  Apache HTTP Server: mod_dav_lock indirect lock crash

  A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was m…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.5
  CVE-2026-34059

  Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

  Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.3
  CVE-2026-29168

  Apache HTTP Server: mod_md unrestricted OCSP response

  Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the i…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 5, 2026
• Medium 6.5
  CVE-2026-33523

  Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

  HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-33007

  Apache HTTP Server: mod_authn_socache crash

  A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-33857

  Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

  Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-34032

  Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

  Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 4.8
  CVE-2026-33006 Public exploit

  Apache HTTP Server: mod_auth_digest timing attack

  A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026

Revision history

1. 2026-11-11 #57

   Neue Updates von Red Hat aufgenommen

2. 2026-11-10 #56

   Neue Updates von Red Hat aufgenommen

3. 2026-11-09 #55

   Neue Updates von XEROX aufgenommen

4. 2026-11-01 #54

   Neue Updates von IBM und Oracle Linux aufgenommen

5. 2026-10-29 #53

   Neue Updates von Red Hat aufgenommen

6. 2026-10-26 #52

   Neue Updates von Oracle Linux aufgenommen

7. 2026-10-22 #51

   Neue Updates von Oracle Linux aufgenommen

8. 2026-10-21 #50

   Neue Updates von IBM aufgenommen

9. 2026-10-14 #49

   Neue Updates von Red Hat aufgenommen

10. 2026-09-29 #48

    Neue Updates von Red Hat aufgenommen

11. 2026-09-13 #47

    Neue Updates von Red Hat aufgenommen

12. 2026-09-10 #46

    Neue Updates von Ubuntu und Oracle Linux aufgenommen

13. 2026-09-09 #45

    Neue Updates von Red Hat aufgenommen

14. 2026-09-01 #44

    Neue Updates von Red Hat aufgenommen

15. 2026-08-31 #43

    Neue Updates von Dell aufgenommen

16. 2026-08-26 #42

    Neue Updates von Oracle Linux aufgenommen

17. 2026-08-25 #41

    Neue Updates von Oracle Linux aufgenommen

18. 2026-08-20 #40

    Neue Updates von Red Hat aufgenommen

19. 2026-08-19 #39

    Neue Updates von Red Hat aufgenommen

20. 2026-08-13 #38

    Neue Updates von Gentoo aufgenommen

21. 2026-08-11 #37

    Neue Updates von Red Hat aufgenommen

22. 2026-08-09 #36

    Neue Updates von Red Hat aufgenommen

23. 2026-07-27 #35

    Neue Updates von Red Hat aufgenommen

24. 2026-07-23 #34

    Neue Updates von Oracle Linux aufgenommen

25. 2026-07-22 #33

    Neue Updates von Rocky Enterprise Software Foundation und Ubuntu aufgenommen

References

• Apache Server Vulnerabilities vom 2026-05-04
  https://httpd.apache.org/security/vulnerabilities_24.html
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-23918
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-24072
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-28780
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-29168
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-29169
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-33006
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-33007
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-33523
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-33857
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-34032
• CVERecord vom 2026-05-04
  https://www.cve.org/CVERecord?id=CVE-2026-34059
• Debian Security Advisory DSA-6248 vom 2026-05-06
  https://security-tracker.debian.org/tracker/DSA-6248-1
• Ubuntu Security Notice USN-8239-1 vom 2026-05-06
  https://ubuntu.com/security/notices/USN-8239-1
• Fedora Security Advisory FEDORA-2026-C9B72DE46A vom 2026-05-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-c9b72de46a
• Fedora Security Advisory FEDORA-2026-707B7050DA vom 2026-05-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-707b7050da
• Red Hat Security Advisory RHSA-2026:13938 vom 2026-05-11
  https://access.redhat.com/errata/RHSA-2026:13938
• IBM Security Bulletin 7272621 vom 2026-05-11
  https://www.ibm.com/support/pages/node/7272621
• Microsoft Security Update Guide vom 2026-05-12
  https://msrc.microsoft.com/update-guide/
• Striga Research PoC CVE-2026-23918 vom 2026-05-12
  https://www.striga.ai/research/apache-httpd-mod-http2-double-free
• Red Hat Security Advisory RHSA-2026:17080 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17080
• Debian Security Advisory DLA-4571 vom 2026-05-14
  https://lists.debian.org/debian-lts-announce/2026/05/msg00027.html
• IBM Security Bulletin 7272831 vom 2026-05-13
  https://www.ibm.com/support/pages/node/7272831
• openSUSE Security Update OPENSUSE-SU-2026:10785-1 vom 2026-05-17
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UE6KE5CJCPUP5Q74XSTDTPNHBY6OS3Q3/
• IBM Security Bulletin 7273764 vom 2026-05-22
  https://www.ibm.com/support/pages/node/7273764
• Amazon Linux Security Advisory ALAS2-2026-3314 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3314.html
• Red Hat Security Advisory RHSA-2026:21433 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:21433
• Red Hat Security Advisory RHSA-2026:21391 vom 2026-05-28
  https://access.redhat.com/errata/RHSA-2026:21391
• SUSE Security Update SUSE-SU-2026:2104-1 vom 2026-05-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026375.html
• SUSE Security Update SUSE-SU-2026:2103-1 vom 2026-05-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026376.html
• Rocky Linux Security Advisory RLSA-2026:21391 vom 2026-05-30
  https://errata.build.resf.org/RLSA-2026:21391
• Rocky Linux Security Advisory RLSA-2026:22140 vom 2026-06-01
  https://errata.build.resf.org/RLSA-2026:22140
• Red Hat Security Advisory RHSA-2026:22140 vom 2026-06-01
  https://access.redhat.com/errata/RHSA-2026:22140
• Oracle Linux Security Advisory ELSA-2026-22140 vom 2026-06-02
  https://linux.oracle.com/errata/ELSA-2026-22140.html
• Rocky Linux Security Advisory RLSA-2026:21433 vom 2026-06-04
  https://errata.build.resf.org/RLSA-2026:21433
• IBM Security Bulletin 7275398 vom 2026-06-08
  https://www.ibm.com/support/pages/node/7275398
• IBM Security Bulletin 7275632 vom 2026-06-09
  https://www.ibm.com/support/pages/node/7275632
• Ubuntu Security Notice USN-8396-1 vom 2026-06-12
  https://ubuntu.com/security/notices/USN-8396-1
• Oracle Linux Security Advisory ELSA-2026-25090 vom 2026-06-17
  https://linux.oracle.com/errata/ELSA-2026-25090.html
• Red Hat Security Advisory RHSA-2026:27201 vom 2026-06-22
  https://access.redhat.com/errata/RHSA-2026:27201
• Red Hat Security Advisory RHSA-2026:27200 vom 2026-06-22
  https://access.redhat.com/errata/RHSA-2026:27200
• SUSE Security Update SUSE-SU-2026:22209-1 vom 2026-06-23
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026889.html
• SUSE Security Update SUSE-SU-2026:22199-1 vom 2026-06-23
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026894.html
• Oracle Linux Security Advisory ELSA-2026-21391 vom 2026-06-25
  http://linux.oracle.com/errata/ELSA-2026-21391.html
• SUSE Security Update SUSE-SU-2026:2641-1 vom 2026-06-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027008.html
• Red Hat Security Advisory RHSA-2026:30845 vom 2026-06-29
  https://access.redhat.com/errata/RHSA-2026:30845
• Oracle Linux Security Advisory ELSA-2026-30844 vom 2026-06-29
  https://linux.oracle.com/errata/ELSA-2026-30844.html
• openSUSE Security Update OPENSUSE-SU-2026:21115-1 vom 2026-06-30
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QXUJOPWBNZ54K6TKGJII6ZDPD5EHDYHZ/
• SUSE Security Update SUSE-SU-2026:2686-1 vom 2026-06-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027074.html
• Red Hat Security Advisory RHSA-2026:34109 vom 2026-07-01
  https://access.redhat.com/errata/RHSA-2026:34109
• Rocky Linux Security Advisory RLSA-2026:30845 vom 2026-07-05
  https://errata.build.resf.org/RLSA-2026:30845
• Rocky Linux Security Advisory RLSA-2026:34109 vom 2026-07-07
  https://errata.build.resf.org/RLSA-2026:34109
• Red Hat Security Advisory RHSA-2026:36373 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36373
• Red Hat Security Advisory RHSA-2026:36831 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36831
• Red Hat Security Advisory RHSA-2026:36846 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36846
• Oracle Linux Security Advisory ELSA-2026-21433 vom 2026-07-17
  https://linux.oracle.com/errata/ELSA-2026-21433.html
• Oracle Linux Security Advisory ELSA-2026-34109 vom 2026-07-17
  http://linux.oracle.com/errata/ELSA-2026-34109.html
• Oracle Linux Security Advisory ELSA-2026-30845 vom 2026-07-17
  http://linux.oracle.com/errata/ELSA-2026-30845.html
• Red Hat Security Advisory RHSA-2026:41906 vom 2026-07-20
  https://access.redhat.com/errata/RHSA-2026:41906
• Oracle Linux Security Advisory ELSA-2026-41906 vom 2026-07-20
  https://linux.oracle.com/errata/ELSA-2026-41906.html
• Ubuntu Security Notice USN-8571-1 vom 2026-07-21
  https://ubuntu.com/security/notices/USN-8571-1
• Red Hat Security Advisory RHSA-2026:42828 vom 2026-07-21
  https://access.redhat.com/errata/RHSA-2026:42828
• Rocky Linux Security Advisory RLSA-2026:42828 vom 2026-07-21
  https://errata.build.resf.org/RLSA-2026:42828
• Rocky Linux Security Advisory RLSA-2026:41906 vom 2026-07-22
  https://errata.build.resf.org/RLSA-2026:41906
• Ubuntu Security Notice USN-8589-1 vom 2026-07-22
  https://ubuntu.com/security/notices/USN-8589-1
• Oracle Linux Security Advisory ELSA-2026-42828 vom 2026-07-23
  https://linux.oracle.com/errata/ELSA-2026-42828.html
• Red Hat Security Advisory RHSA-2026:47046 vom 2026-07-28
  https://access.redhat.com/errata/RHSA-2026:47046
• Red Hat Security Advisory RHSA-2026:52393 vom 2026-08-10
  https://access.redhat.com/errata/RHSA-2026:52393
• Red Hat Security Advisory RHSA-2026:53371 vom 2026-08-11
  https://access.redhat.com/errata/RHSA-2026:53371
• Gentoo Linux Security Advisory GLSA-202608-05 vom 2026-08-14
  https://security.gentoo.org/glsa/202608-05
• Red Hat Security Advisory RHSA-2026:56869 vom 2026-08-19
  https://access.redhat.com/errata/RHSA-2026:56869
• Red Hat Security Advisory RHSA-2026:57641 vom 2026-08-20
  https://access.redhat.com/errata/RHSA-2026:57641
• Red Hat Security Advisory RHSA-2026:57844 vom 2026-08-21
  https://access.redhat.com/errata/RHSA-2026:57844
• Red Hat Security Advisory RHSA-2026:57642 vom 2026-08-20
  https://access.redhat.com/errata/RHSA-2026:57642
• Oracle Linux Security Advisory ELSA-2026-59347 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-59347.html
• Oracle Linux Security Advisory ELSA-2026-60004 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-60004-0.html
• Dell Security Advisory DSA-2026-386 vom 2026-09-01
  https://www.dell.com/support/kbdoc/000503504/dsa-2026-386-security-update-f
• Red Hat Security Advisory RHSA-2026:62165 vom 2026-09-01
  https://access.redhat.com/errata/RHSA-2026:62165
• Red Hat Security Advisory RHSA-2026:66323 vom 2026-09-10
  https://access.redhat.com/errata/RHSA-2026:66323
• Ubuntu Security Notice USN-8571-2 vom 2026-09-11
  https://ubuntu.com/security/notices/USN-8571-2