https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:49:41.506308+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:59347 ALSA-2026:59347 — Low: httpd security update 2026-10-03T11:49:41.579940+00:00

Affected: AlmaLinux:9: httpd, AlmaLinux:9: httpd-core, AlmaLinux:9: httpd-devel, AlmaLinux:9: httpd-filesystem, AlmaLinux:9: httpd-manual, AlmaLinux:9: httpd-tools, AlmaLinux:9: mod_ldap, AlmaLinux:9: mod_lua, AlmaLinux:9: mod_proxy_html, AlmaLinux:9: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-09758 bdu:2026-09758 2026-10-03T11:49:41.580025+00:00 bdu:2026-09758 https://cve.radiocsirt.org/vuln/bell-cve-2026-29167 BELL-CVE-2026-29167 2026-10-03T11:49:41.580043+00:00

Affected: Alpaquita:23: apache2, Alpaquita:25: apache2, Alpaquita:stream: apache2

 https://cve.radiocsirt.org/vuln/bit-apache-2026-29167 BIT-apache-2026-29167 — Apache HTTP Server: mod_ldap per-dir use-after-free 2026-10-03T11:49:41.580064+00:00

Affected: Bitnami: apache

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0710 certfr-2026-avi-0710 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu… 2026-10-03T11:49:41.580086+00:00 certfr-2026-avi-0710 https://cve.radiocsirt.org/vuln/euvd-2026-325766 EUVD-2026-325766 2026-10-03T11:49:41.580102+00:00 EUVD-2026-325766 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29167 fkie_cve-2026-29167 2026-10-03T11:49:41.580112+00:00

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-85f4-9pxx-739j GHSA-85f4-9pxx-739j 2026-10-03T11:49:41.580133+00:00

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-29167 msrc_CVE-2026-29167 — Apache HTTP Server: mod_ldap per-dir use-after-free 2026-10-03T11:49:41.580148+00:00 msrc_CVE-2026-29167 https://cve.radiocsirt.org/vuln/ncsc-2026-0256 NCSC-2026-0256 — Kwetsbaarheden verholpen in Oracle Communications 2026-10-03T11:49:41.580164+00:00 NCSC-2026-0256 https://cve.radiocsirt.org/vuln/oesa-2026-2744 OESA-2026-2744 — httpd security update 2026-10-03T11:49:41.580191+00:00

Affected: openEuler:20.03-LTS-SP4: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21235-1 openSUSE-SU-2026:21235-1 — Security update for apache2 2026-10-03T11:49:41.580234+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/rhsa-2026:25042 RHSA-2026:25042 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T11:49:41.580258+00:00

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server httpd: Apache HTTP Server: Denial of Service via crafted regular expressions httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

 https://cve.radiocsirt.org/vuln/rlsa-2026:59347 RLSA-2026:59347 — Low: httpd security update 2026-10-03T11:49:41.580295+00:00

Affected: Rocky Linux:9: httpd

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22564-1 SUSE-SU-2026:22564-1 — Security update for apache2 2026-10-03T11:49:41.580318+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-29167 UBUNTU-CVE-2026-29167 2026-10-03T11:49:41.580341+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:Pro:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2, Ubuntu:25.10: apache2, Ubuntu:26.04:LTS: apache2

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1824 WID-SEC-W-2026-1824 — Apache HTTP Server: Mehrere Schwachstellen 2026-10-03T11:49:41.580369+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu verändern und offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht näher definierte Angriffe durchzuführen.