Most recent entries from all

ALSA-2026:34355 — Moderate: mod_http2 security, bug fix, and enhancement update

2026-10-03T18:08:25.981421+00:00

Affected: AlmaLinux:10: mod_http2

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

* address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-09754

2026-10-03T18:08:25.981533+00:00

bdu:2026-09754

BELL-CVE-2026-43951

2026-10-03T18:08:25.981555+00:00

Affected: Alpaquita:23: apache2, Alpaquita:25: apache2, Alpaquita:stream: apache2

BIT-apache-2026-43951 — Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

2026-10-03T18:08:25.981578+00:00

Affected: Bitnami: apache

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

certfr-2026-avi-0710 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu…

2026-10-03T18:08:25.981601+00:00

certfr-2026-avi-0710

EUVD-2026-325674

2026-10-03T18:08:25.981617+00:00

EUVD-2026-325674

fkie_cve-2026-43951

2026-10-03T18:08:25.981629+00:00

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

GHSA-4qxr-h6g3-8f95

2026-10-03T18:08:25.981650+00:00

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

jvndb-2026-026851

2026-10-03T18:08:25.981665+00:00

Vulnerability(CVE-2026-43951) has been found in Cosminexus HTTP Server and Hitachi Web Server.

msrc_CVE-2026-43951 — Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

2026-10-03T18:08:25.981681+00:00

msrc_CVE-2026-43951

OESA-2026-2746 — httpd security update

2026-10-03T18:08:25.981697+00:00

Affected: openEuler:24.03-LTS-SP1: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability…

openSUSE-SU-2026:21235-1 — Security update for apache2

2026-10-03T18:08:25.981746+00:00

Security update for apache2

RHSA-2026:25042 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-03T18:08:25.981770+00:00

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server httpd: Apache HTTP Server: Denial of Service via crafted regular expressions httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

RLSA-2026:34109 — Important: httpd security, bug fix, and enhancement update

2026-10-03T18:08:25.981808+00:00

Affected: Rocky Linux:10: httpd

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)

* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)

* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

Bug Fix(es) and Enhancement(s):

* address Moderate severity issues from httpd 2.4.68 [rhel-10.2.z] (JIRA:Rocky Linux-184518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22564-1 — Security update for apache2

2026-10-03T18:08:25.981840+00:00

Security update for apache2

UBUNTU-CVE-2026-43951

2026-10-03T18:08:25.981862+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:Pro:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2, Ubuntu:25.10: apache2, Ubuntu:26.04:LTS: apache2

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

WID-SEC-W-2026-1824 — Apache HTTP Server: Mehrere Schwachstellen

2026-10-03T18:08:25.981893+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu verändern und offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht näher definierte Angriffe durchzuführen.