Apache HTTP Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 13

• Critical 9.8
  CVE-2026-29167

  Apache HTTP Server: mod_ldap per-dir use-after-free

  Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Critical 9.8
  CVE-2026-44631

  Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

  Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Critical 9.1
  CVE-2026-42535

  Apache HTTP Server: mod_dav_fs protected directory access

  A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes t…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.5
  CVE-2026-34355

  Apache HTTP Server: mod_proxy_html buffer overflow

  A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.5
  CVE-2026-34356

  Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow

  Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the iss…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.5
  CVE-2026-42536 Public exploit

  Apache HTTP Server: mod_xml2enc heap overflow

  Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.5
  CVE-2026-49975 Public exploit EPSS 33%

  Apache HTTP Server: mod_http2 denial of service

  Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.3
  CVE-2026-44185

  Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

  Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.3
  CVE-2026-44186

  Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.3
  CVE-2026-48913

  Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

  Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Medium 6.5
  CVE-2026-43951

  Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

  Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Medium 6.1
  CVE-2026-29170

  Apache HTTP Server: mod_proxy_ftp XSS

  A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to upgrade to v…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Medium 5.5
  CVE-2026-44119

  Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules

  Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgra…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026

Revision history

1. 2026-11-11 #47

   Neue Updates von Red Hat aufgenommen

2. 2026-11-10 #46

   Neue Updates von Red Hat aufgenommen

3. 2026-11-09 #45

   Neue Updates von XEROX aufgenommen

4. 2026-10-29 #44

   Neue Updates von Red Hat aufgenommen

5. 2026-10-26 #43

   Neue Updates von Oracle Linux aufgenommen

6. 2026-10-22 #42

   Neue Updates von Oracle Linux aufgenommen

7. 2026-10-21 #41

   Neue Updates von IBM aufgenommen

8. 2026-10-14 #40

   Neue Updates von Red Hat aufgenommen

9. 2026-09-21 #39

   Neue Updates von IBM aufgenommen

10. 2026-09-13 #38

    Neue Updates von Red Hat aufgenommen

11. 2026-09-10 #37

    Neue Updates von Ubuntu und Oracle Linux aufgenommen

12. 2026-09-09 #36

    Neue Updates von Red Hat aufgenommen

13. 2026-09-08 #35

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

14. 2026-09-07 #34

    Neue Updates von Red Hat aufgenommen

15. 2026-09-01 #33

    Neue Updates von Red Hat aufgenommen

16. 2026-08-31 #32

    Neue Updates von Dell aufgenommen

17. 2026-08-26 #31

    Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

18. 2026-08-25 #30

    Neue Updates von Oracle Linux und Red Hat aufgenommen

19. 2026-08-24 #29

    Neue Updates von IBM aufgenommen

20. 2026-08-19 #28

    Neue Updates von Red Hat aufgenommen

21. 2026-08-17 #27

    Neue Updates von Red Hat aufgenommen

22. 2026-08-13 #26

    Neue Updates von Gentoo aufgenommen

23. 2026-08-12 #25

    Neue Updates von Fortinet aufgenommen

24. 2026-08-11 #24

    Neue Updates von Red Hat und F5 aufgenommen

25. 2026-08-04 #23

    Neue Updates von Red Hat aufgenommen

References

• Apache Vulnerabilities vom 2026-06-08
  https://httpd.apache.org/security/vulnerabilities_24.html
• Microsoft Security Update Guide vom 2026-06-09
  https://msrc.microsoft.com/update-guide/
• Rocky Linux Security Advisory RLSA-2026:25090 vom 2026-06-11
  https://errata.build.resf.org/RLSA-2026:25090
• Red Hat Security Advisory RHSA-2026:25057 vom 2026-06-10
  https://access.redhat.com/errata/RHSA-2026:25057
• Red Hat Security Advisory RHSA-2026:25090 vom 2026-06-10
  https://access.redhat.com/errata/RHSA-2026:25090
• Red Hat Security Advisory RHSA-2026:25225 vom 2026-06-11
  https://access.redhat.com/errata/RHSA-2026:25225
• Rocky Linux Security Advisory RLSA-2026:25225 vom 2026-06-13
  https://errata.build.resf.org/RLSA-2026:25225
• Debian Security Advisory DLA-4629 vom 2026-06-12
  https://lists.debian.org/debian-lts-announce/2026/06/msg00018.html
• Rocky Linux Security Advisory RLSA-2026:25057 vom 2026-06-13
  https://errata.build.resf.org/RLSA-2026:25057
• IBM Security Bulletin 7276565 vom 2026-06-16
  https://www.ibm.com/support/pages/node/7276565
• Oracle Linux Security Advisory ELSA-2026-25090 vom 2026-06-17
  https://linux.oracle.com/errata/ELSA-2026-25090.html
• PoC CVE-2026-49975 vom 2026-06-18
  https://github.com/EQSTLab/CVE-2026-49975
• IBM Security Bulletin 7277034 vom 2026-06-18
  https://www.ibm.com/support/pages/node/7277034
• Red Hat Security Advisory RHSA-2026:27114 vom 2026-06-18
  https://access.redhat.com/errata/RHSA-2026:27114
• Red Hat Security Advisory RHSA-2026:27201 vom 2026-06-22
  https://access.redhat.com/errata/RHSA-2026:27201
• Red Hat Security Advisory RHSA-2026:27200 vom 2026-06-22
  https://access.redhat.com/errata/RHSA-2026:27200
• Amazon Linux Security Advisory ALAS2-2026-3372 vom 2026-06-22
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3372.html
• Amazon Linux Security Advisory ALAS2-2026-3379 vom 2026-06-22
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3379.html
• Oracle Linux Security Advisory ELSA-2026-25057 vom 2026-06-25
  https://linux.oracle.com/errata/ELSA-2026-25057.html
• SUSE Security Update SUSE-SU-2026:2686-1 vom 2026-06-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027074.html
• Red Hat Security Advisory RHSA-2026:34109 vom 2026-07-01
  https://access.redhat.com/errata/RHSA-2026:34109
• SUSE Security Update SUSE-SU-2026:2735-1 vom 2026-07-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027218.html
• SUSE Security Update SUSE-SU-2026:2759-1 vom 2026-07-06
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027291.html
• Rocky Linux Security Advisory RLSA-2026:34109 vom 2026-07-07
  https://errata.build.resf.org/RLSA-2026:34109
• Red Hat Security Advisory RHSA-2026:36373 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36373
• Rocky Linux Security Advisory RLSA-2026:34355 vom 2026-07-07
  https://errata.build.resf.org/RLSA-2026:34355
• openSUSE Security Update OPENSUSE-SU-2026:21235-1 vom 2026-07-08
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O3XLGVT2UENVEDUTQFXRVGMTPKONKGSU/
• Ubuntu Security Notice USN-8516-1 vom 2026-07-08
  https://ubuntu.com/security/notices/USN-8516-1
• Red Hat Security Advisory RHSA-2026:36831 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36831
• Red Hat Security Advisory RHSA-2026:36846 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36846
• SUSE Security Update SUSE-SU-2026:22564-1 vom 2026-07-14
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027447.html
• Oracle Linux Security Advisory ELSA-2026-21433 vom 2026-07-17
  https://linux.oracle.com/errata/ELSA-2026-21433.html
• Oracle Linux Security Advisory ELSA-2026-34355 vom 2026-07-17
  http://linux.oracle.com/errata/ELSA-2026-34355.html
• Oracle Linux Security Advisory ELSA-2026-34109 vom 2026-07-17
  http://linux.oracle.com/errata/ELSA-2026-34109.html
• Oracle Linux Security Advisory ELSA-2026-22528 vom 2026-07-17
  https://linux.oracle.com/errata/ELSA-2026-22528.html
• Red Hat Security Advisory RHSA-2026:34355 vom 2026-07-20
  https://adv-archiv.dfn-cert.de/adv/2026-3054/
• Red Hat Security Advisory RHSA-2026:41906 vom 2026-07-20
  https://access.redhat.com/errata/RHSA-2026:41906
• Oracle Linux Security Advisory ELSA-2026-25225 vom 2026-07-20
  https://linux.oracle.com/errata/ELSA-2026-25225.html
• Oracle Linux Security Advisory ELSA-2026-41906 vom 2026-07-20
  https://linux.oracle.com/errata/ELSA-2026-41906.html
• Ubuntu Security Notice USN-8571-1 vom 2026-07-21
  https://ubuntu.com/security/notices/USN-8571-1
• Rocky Linux Security Advisory RLSA-2026:42828 vom 2026-07-21
  https://errata.build.resf.org/RLSA-2026:42828
• Red Hat Security Advisory RHSA-2026:42828 vom 2026-07-21
  https://access.redhat.com/errata/RHSA-2026:42828
• IBM Security Bulletin 7280528 vom 2026-07-21
  https://www.ibm.com/support/pages/node/7280528
• Rocky Linux Security Advisory RLSA-2026:41906 vom 2026-07-22
  https://errata.build.resf.org/RLSA-2026:41906
• Ubuntu Security Notice USN-8589-1 vom 2026-07-22
  https://ubuntu.com/security/notices/USN-8589-1
• Oracle Linux Security Advisory ELSA-2026-42828 vom 2026-07-23
  https://linux.oracle.com/errata/ELSA-2026-42828.html
• IBM Security Bulletin 7280970 vom 2026-07-23
  https://www.ibm.com/support/pages/node/7280970
• Red Hat Security Advisory RHSA-2026:47046 vom 2026-07-28
  https://access.redhat.com/errata/RHSA-2026:47046
• Red Hat Security Advisory RHSA-2026:50572 vom 2026-08-05
  https://access.redhat.com/errata/RHSA-2026:50572
• Red Hat Security Advisory RHSA-2026:50538 vom 2026-08-05
  https://access.redhat.com/errata/RHSA-2026:50538
• Red Hat Security Advisory RHSA-2026:53371 vom 2026-08-11
  https://access.redhat.com/errata/RHSA-2026:53371
• F5 Security Advisory K000162870 vom 2026-08-11
  https://my.f5.com/manage/s/article/K000162870
• FortiGuard Labs PSIRT Advisory FG-IR-26-163 vom 2026-08-12
  https://www.fortiguard.com/psirt/FG-IR-26-163
• Gentoo Linux Security Advisory GLSA-202608-05 vom 2026-08-14
  https://security.gentoo.org/glsa/202608-05
• Red Hat Security Advisory RHSA-2026:55930 vom 2026-08-18
  https://access.redhat.com/errata/RHSA-2026:55930
• Red Hat Security Advisory RHSA-2026:55992 vom 2026-08-18
  https://access.redhat.com/errata/RHSA-2026:55992
• Red Hat Security Advisory RHSA-2026:56869 vom 2026-08-19
  https://access.redhat.com/errata/RHSA-2026:56869
• IBM Security Bulletin 7284909 vom 2026-08-25
  https://www.ibm.com/support/pages/node/7284909
• Oracle Linux Security Advisory ELSA-2026-59347 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-59347.html
• Red Hat Security Advisory RHSA-2026:59387 vom 2026-08-26
  https://access.redhat.com/errata/RHSA-2026:59387
• Oracle Linux Security Advisory ELSA-2026-59387 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-59387.html
• Red Hat Security Advisory RHSA-2026:60004 vom 2026-08-26
  https://access.redhat.com/errata/RHSA-2026:60004
• Oracle Linux Security Advisory ELSA-2026-60004 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-60004-0.html
• Rocky Linux Security Advisory RLSA-2026:60004 vom 2026-08-26
  https://errata.build.resf.org/RLSA-2026:60004
• Rocky Linux Security Advisory RLSA-2026:59387 vom 2026-08-26
  https://errata.build.resf.org/RLSA-2026:59387
• Rocky Linux Security Advisory RLSA-2026:59347 vom 2026-08-26
  https://errata.build.resf.org/RLSA-2026:59347
• Dell Security Advisory DSA-2026-386 vom 2026-09-01
  https://www.dell.com/support/kbdoc/000503504/dsa-2026-386-security-update-f
• Red Hat Security Advisory RHSA-2026:62165 vom 2026-09-01
  https://access.redhat.com/errata/RHSA-2026:62165
• Red Hat Security Advisory RHSA-2026:64794 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:64794
• Rocky Linux Security Advisory RLSA-2026:64794 vom 2026-09-08
  https://errata.build.resf.org/RLSA-2026:64794
• Red Hat Security Advisory RHSA-2026:66323 vom 2026-09-10
  https://access.redhat.com/errata/RHSA-2026:66323
• Ubuntu Security Notice USN-8571-2 vom 2026-09-11
  https://ubuntu.com/security/notices/USN-8571-2
• Oracle Linux Security Advisory ELSA-2026-64794 vom 2026-09-10
  https://linux.oracle.com/errata/ELSA-2026-64794-0.html
• Red Hat Security Advisory RHSA-2026:67152 vom 2026-09-14
  https://access.redhat.com/errata/RHSA-2026:67152
• IBM Security Bulletin 7288811 vom 2026-09-22
  https://www.ibm.com/support/pages/node/7288811
• Red Hat Security Advisory RHSA-2026:56868 vom 2026-10-15
  https://access.redhat.com/errata/RHSA-2026:56868
• IBM Security Bulletin 7293281 vom 2026-10-21
  https://www.ibm.com/support/pages/node/7293281
• Oracle Linux Security Advisory ELSA-2026-88229 vom 2026-10-23
  https://linux.oracle.com/errata/ELSA-2026-88229.html
• Oracle Linux Security Advisory ELSA-2026-89860 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-89860.html
• Oracle Linux Security Advisory ELSA-2026-89860 vom 2026-10-26
  https://linux.oracle.com/errata/ELSA-2026-89860.html