Every CVE Search/ Get API key

CVE-2026-29168

Apache HTTP Server: mod_md unrestricted OCSP response

7.3 HighFix available

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.63%Up 0.6 points since May 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.3

Apache HTTP Server: mod_md unrestricted OCSP response

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
CVE-2026-29168
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-27321 7.3

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
EUVD-2026-27321
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-h688-wmf2-q99q 7.3

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's ...

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
GHSA-h688-wmf2-q99q
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-770
Updated
2026-11-02
NVD 7.3

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
CVE-2026-29168
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2026-29168 7.3

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
ALPINE-CVE-2026-29168
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVBELL-CVE-2026-29168 7.3
Record
BELL-CVE-2026-29168
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 35 moreShow less
OSV 7.3

Apache HTTP Server: mod_md unrestricted OCSP response

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
CVE-2026-29168
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-770
Updated
2026-11-05
OSVDEBIAN-CVE-2026-29168 7.3

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
DEBIAN-CVE-2026-29168
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-2316 9.8

httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-24072)

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-28780)

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-29168)

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.(CVE-2026-29169)

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33006)

Buffer Over-read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34059)

Record
OESA-2026-2316
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2318 9.8

httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-24072)

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-28780)

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-29168)

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.(CVE-2026-29169)

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33006)

Buffer Over-read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34059)

Record
OESA-2026-2318
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2319 9.8

httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-24072)

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-28780)

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-29168)

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.(CVE-2026-29169)

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33006)

Buffer Over-read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34059)

Record
OESA-2026-2319
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2320 9.8

httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-24072)

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-28780)

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-29168)

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.(CVE-2026-29169)

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33006)

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33007)

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.

This issue affects Apache HTTP Server: from through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33523)

Out-of-bounds Read vulnerability in mod_proxy_ajp of

Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33857)

Buffer Over-read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34059)

Record
OESA-2026-2320
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2401 8.8

httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-24072)

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-29168)

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.(CVE-2026-29169)

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33006)

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33007)

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.

This issue affects Apache HTTP Server: from through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33523)

Out-of-bounds Read vulnerability in mod_proxy_ajp of

Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33857)

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34032)

Buffer Over-read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34059)

Record
OESA-2026-2401
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:27200 8.2

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update

Record
RHSA-2026:27200
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:30844 7.5

Red Hat Security Advisory: mod_md security update

Record
RHSA-2026:30844
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:30845 7.5

Red Hat Security Advisory: mod_md security update

Record
RHSA-2026:30845
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:52393 7.5

Red Hat Security Advisory: mod_md security update

Record
RHSA-2026:52393
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:53537 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:53537
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:57641 7.5

Red Hat Security Advisory: mod_md security update

Record
RHSA-2026:57641
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:57642 7.5

Red Hat Security Advisory: mod_md security update

Record
RHSA-2026:57642
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:57844 7.5

Red Hat Security Advisory: mod_md security update

Record
RHSA-2026:57844
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:30844 7.5

Moderate: mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

  • httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:30844
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:30845 7.5

Moderate: mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

  • httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:30845
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-29168 7.3

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
UBUNTU-CVE-2026-29168
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVALSA-2026:30844 No score

Moderate: mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

  • httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:30844
Updated
2026-11-02
OSVALSA-2026:30845 No score

Moderate: mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

  • httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:30845
Updated
2026-11-02
OSVAZL-85871 No score

CVE-2026-29168 affecting package mod_md 2.4.26-3

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
AZL-85871
Updated
2026-11-05
OSVAZL-85995 No score

CVE-2026-29168 affecting package httpd for versions less than 2.4.67-1

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
AZL-85995
Updated
2026-11-02
OSVBIT-apache-2026-29168 No score

Apache HTTP Server: mod_md unrestricted OCSP response

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Record
BIT-apache-2026-29168
Updated
2026-11-02
OSVCLSA-2026-1779797547 No score

Fix CVE(s): CVE-2026-29168

  • SECURITY UPDATE: fix denial of service in mod_md OCSP response handling by enforcing size limit and timeouts
    • debian/patches/CVE-2026-29168.patch: fix denial of service in mod_md OCSP response handling by enforcing size limit and timeouts
    • CVE-2026-29168
Record
CLSA-2026-1779797547
Updated
2026-11-02
OSVCLSA-2026-1782919559 No score

mod_md: Fix of CVE-2026-29168

  • CVE-2026-29168: add OCSP response size, timeout and stalling limits
Record
CLSA-2026-1782919559
Updated
2026-11-02
OSVCLSA-2026-1783351991 No score

mod_md: Fix of CVE-2026-29168

  • CVE-2026-29168: limit OCSP response size and add timeouts to prevent unbounded memory allocation
Record
CLSA-2026-1783351991
Updated
2026-11-02
OSVMGASA-2026-0129 No score

Updated apache packages fix security vulnerabilities

http2: double free and possible RCE on early reset. (CVE-2026-23918) mod_rewrite elevation of privileges via ap_expr. (CVE-2026-24072) buffer overflow in mod_proxy_ajp via ajp_msg_check_header(). (CVE-2026-28780) mod_md unrestricted OCSP response. (CVE-2026-29168) mod_dav_lock indirect lock crash. (CVE-2026-29169) mod_auth_digest timing attack. (CVE-2026-33006) mod_authn_socache crash. (CVE-2026-33007) HTTP response splitting forwarding malicious status line. (CVE-2026-33523) Off-by-one OOB reads in AJP getter functions. (CVE-2026-33857) Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string). (CVE-2026-34032) Heap Over-Read and memory disclosure in ajp_parse_data(). (CVE-2026-34059)

Record
MGASA-2026-0129
Updated
2026-11-02
OSVopenSUSE-SU-2026:10785-1 No score

apache2-2.4.67-1.1 on GA media

These are all security issues fixed in the apache2-2.4.67-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10785-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21115-1 No score

Security update for apache2

This update for apache2 fixes the following issues

  • CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
  • CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
  • CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
  • CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
  • CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
  • CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
  • CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
  • CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
  • CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
  • CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
  • CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
Record
openSUSE-SU-2026:21115-1
Updated
2026-11-02
OSVSUSE-SU-2026:2103-1 No score

Security update for apache2

This update for apache2 fixes the following issues

  • CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
  • CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
  • CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
  • CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
  • CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
  • CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
  • CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
  • CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
  • CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
  • CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
  • CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
Record
SUSE-SU-2026:2103-1
Updated
2026-11-02
OSVSUSE-SU-2026:2104-1 No score

Security update for apache2

This update for apache2 fixes the following issues

  • CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
  • CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
  • CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
  • CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
  • CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
  • CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
  • CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
  • CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
  • CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
  • CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
  • CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
Record
SUSE-SU-2026:2104-1
Updated
2026-11-02
OSVSUSE-SU-2026:22199-1 No score

Security update for apache2

This update for apache2 fixes the following issues

  • CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
  • CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
  • CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
  • CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
  • CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
  • CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
  • CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
  • CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
  • CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
  • CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
  • CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
Record
SUSE-SU-2026:22199-1
Updated
2026-11-02
OSVSUSE-SU-2026:22209-1 No score

Security update for apache2

This update for apache2 fixes the following issues

  • CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
  • CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
  • CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
  • CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
  • CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
  • CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
  • CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
  • CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
  • CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
  • CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
  • CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
Record
SUSE-SU-2026:22209-1
Updated
2026-11-02
OSVSUSE-SU-2026:2641-1 No score

Security update for apache2

This update for apache2 fixes the following issues

Update to 2.4.66 (jsc#PED-16334):

Security issues:

  • CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
  • CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
  • CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
  • CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
  • CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
  • CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
  • CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
  • CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
  • CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
  • CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
  • CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).

Non security issue:

  • Internal server error on very long URL (bsc#690734).
Record
SUSE-SU-2026:2641-1
Updated
2026-11-02
OSVSUSE-SU-2026:2686-1 No score

Security update for apache2

This update for apache2 fixes the following issues

  • CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
  • CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
  • CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
  • CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
  • CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
  • CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
  • CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
  • CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
  • CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
  • CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
  • CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
  • CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
  • CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
  • CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
  • CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
  • CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
  • CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
  • CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
  • CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
  • CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
  • CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
  • CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
  • CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
  • CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Non security issue:

  • Update to 2.4.66 (jsc#PED-16334).
Record
SUSE-SU-2026:2686-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Alpine:v3.20
 before 2.4.67-r0
2.4.67-r0
apache2
Alpine:v3.21
 before 2.4.67-r0
2.4.67-r0
apache2
Alpine:v3.22
 before 2.4.67-r0
2.4.67-r0
apache2
Alpine:v3.23
 before 2.4.67-r0
2.4.67-r0
apache2
Alpine:v3.24
 before 2.4.67-r0
2.4.67-r0
mod_md
AlmaLinux:9
 before 1:2.4.26-2.el9_8.1
1:2.4.26-2.el9_8.1
mod_md
AlmaLinux:10
 before 1:2.4.26-5.el10_2.1
1:2.4.26-5.el10_2.1
mod_md
Azure Linux:3
 through 2.4.26-3 None known
httpd
Azure Linux:3
 before 2.4.67-1
2.4.67-1
apache2
Alpaquita:23
 2.4.54-r2 up to 2.4.67-r0
2.4.67-r0
Show 125 moreShow less
Affected packages
PackageAffectedFixed
apache2
Alpaquita:25
 2.4.63-r0 up to 2.4.67-r0
2.4.67-r0
apache2
Alpaquita:stream
 2.4.56-r0 up to 2.4.67-r0
2.4.67-r0
apache
Bitnami
 2.4.30 up to 2.4.67
2.4.67
apache2
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-bin
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-data
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-dev
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-doc
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-ssl-dev
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-suexec-custom
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-suexec-pristine
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
apache2-utils
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
libapache2-mod-md
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
libapache2-mod-proxy-uwsgi
TuxCare:Debian:10
 before 2.4.59-1~deb10u1+tuxcare.els6
2.4.59-1~deb10u1+tuxcare.els6
mod_md
TuxCare:AlmaLinux:9.6
 before 1:2.4.26-1.el9.tuxcare.els2
1:2.4.26-1.el9.tuxcare.els2
mod_md
TuxCare:AlmaLinux:9.2
 before 1:2.4.19-1.el9.tuxcare.els2
1:2.4.19-1.el9.tuxcare.els2
apache2
Debian:12
 before 2.4.67-1~deb12u2, plus listed versions
2.4.57-22.4.57-32.4.58-12.4.59-12.4.59-1~deb10u1
Show 41 moreShow less
2.4.59-1~deb11u12.4.59-1~deb12u12.4.59-22.4.60-12.4.61-12.4.61-1~deb11u12.4.61-1~deb12u12.4.62-12.4.62-1~deb11u12.4.62-1~deb11u22.4.62-1~deb12u12.4.62-1~deb12u22.4.62-22.4.62-32.4.62-42.4.62-52.4.62-62.4.63-12.4.64-12.4.65-12.4.65-1~deb11u12.4.65-1~deb12u12.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u12.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u1
2.4.67-1~deb12u2
apache2
Debian:13
 before 2.4.67-1~deb13u2, plus listed versions
2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1
Show 17 moreShow less
2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u1
2.4.67-1~deb13u2
apache2
Debian:14
 before 2.4.67-1, plus listed versions
2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1
Show 19 moreShow less
2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u3
2.4.67-1
apache
Mageia:9
From an advisory covering 11 CVEs
 before 2.4.67-1.mga9
2.4.67-1.mga9
httpd
openEuler:24.03-LTS-SP3
From an advisory covering 6 CVEs
 before 2.4.58-14.oe2403sp3
2.4.58-14.oe2403sp3
httpd
openEuler:22.03-LTS-SP4
From an advisory covering 6 CVEs
 before 2.4.51-29.oe2203sp4
2.4.51-29.oe2203sp4
httpd
openEuler:24.03-LTS
From an advisory covering 6 CVEs
 before 2.4.58-14.oe2403
2.4.58-14.oe2403
httpd
openEuler:24.03-LTS-SP1
From an advisory covering 9 CVEs
 before 2.4.58-15.oe2403sp1
2.4.58-15.oe2403sp1
httpd
openEuler:20.03-LTS-SP4
From an advisory covering 9 CVEs
 before 2.4.43-35.oe2003sp4
2.4.43-35.oe2003sp4
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-mod_http2
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el7jbcs
0:2.0.29-10.el7jbcs
jbcs-httpd24-mod_http2-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el7jbcs
0:2.0.29-10.el7jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el7jbcs
1:2.4.62-13.el7jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el7jbcs
1:2.4.62-13.el7jbcs
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-tools-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_http2
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el8jbcs
0:2.0.29-10.el8jbcs
jbcs-httpd24-mod_http2-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el8jbcs
0:2.0.29-10.el8jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_ldap-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-mod_proxy_html-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_session-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-mod_ssl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-nghttp2
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el7jbcs
0:1.64.0-3.el7jbcs
jbcs-httpd24-nghttp2-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el7jbcs
0:1.64.0-3.el7jbcs
jbcs-httpd24-nghttp2-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el7jbcs
0:1.64.0-3.el7jbcs
jbcs-httpd24-nghttp2
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el8jbcs
0:1.64.0-3.el8jbcs
jbcs-httpd24-nghttp2-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el8jbcs
0:1.64.0-3.el8jbcs
jbcs-httpd24-nghttp2-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el8jbcs
0:1.64.0-3.el8jbcs
jbcs-httpd24-mod_md
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el7jbcs
1:2.4.28-16.el7jbcs
jbcs-httpd24-mod_md-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el7jbcs
1:2.4.28-16.el7jbcs
jbcs-httpd24-mod_md
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el8jbcs
1:2.4.28-16.el8jbcs
jbcs-httpd24-mod_md-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el8jbcs
1:2.4.28-16.el8jbcs
mod_md
Red Hat:enterprise_linux:9::appstream
 before 1:2.4.26-2.el9_8.1
1:2.4.26-2.el9_8.1
mod_md-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:2.4.26-2.el9_8.1
1:2.4.26-2.el9_8.1
mod_md-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:2.4.26-2.el9_8.1
1:2.4.26-2.el9_8.1
mod_md
Red Hat:enterprise_linux:10.2
 before 1:2.4.26-5.el10_2.1
1:2.4.26-5.el10_2.1
mod_md-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:2.4.26-5.el10_2.1
1:2.4.26-5.el10_2.1
mod_md-debugsource
Red Hat:enterprise_linux:10.2
 before 1:2.4.26-5.el10_2.1
1:2.4.26-5.el10_2.1
mod_md
Red Hat:enterprise_linux_eus:10.0
 before 1:2.4.26-3.el10_0.2
1:2.4.26-3.el10_0.2
httpd
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
httpd-core
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
httpd-devel
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
httpd-filesystem
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
httpd-manual
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
httpd-tools
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
mod_ldap
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
mod_lua
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
mod_proxy_html
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
mod_session
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
mod_ssl
Red Hat:hummingbird:1
 before 0:2.4.68-6.hum1
0:2.4.68-6.hum1
mod_md
Red Hat:rhel_eus:9.6::appstream
 before 1:2.4.26-1.el9_6.2
1:2.4.26-1.el9_6.2
mod_md
Red Hat:rhel_e4s:9.2::appstream
 before 1:2.4.19-1.el9_2.2
1:2.4.19-1.el9_2.2
mod_md
Red Hat:rhel_e4s:9.4::appstream
 before 1:2.4.19-1.el9_4.2
1:2.4.19-1.el9_4.2
mod_md
Rocky Linux:9
 before 1:2.4.26-2.el9_8.1
1:2.4.26-2.el9_8.1
mod_md
Rocky Linux:10
 before 1:2.4.26-5.el10_2.1
1:2.4.26-5.el10_2.1
apache2
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-devel
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-event
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-manual
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-prefork
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-utils
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-worker
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-devel
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-event
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-manual
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-prefork
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-utils
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-worker
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 11 CVEs
 before 2.4.66-35.78.1
2.4.66-35.78.1
apache2-tls13
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 11 CVEs
 before 2.4.66-35.78.1
2.4.66-35.78.1
apache2
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 11 CVEs
 before 2.4.66-35.78.1
2.4.66-35.78.1
apache2-tls13
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 11 CVEs
 before 2.4.66-35.78.1
2.4.66-35.78.1
apache2
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 66 CVEs
 before 2.4.66-150400.6.57.1
2.4.66-150400.6.57.1
apache2
Ubuntu:22.04:LTS
 before 2.4.52-1ubuntu4.20, plus listed versions
2.4.48-3.1ubuntu32.4.48-3.1ubuntu42.4.51-2ubuntu12.4.52-1ubuntu12.4.52-1ubuntu2
Show 19 moreShow less
2.4.52-1ubuntu42.4.52-1ubuntu4.12.4.52-1ubuntu4.22.4.52-1ubuntu4.32.4.52-1ubuntu4.42.4.52-1ubuntu4.52.4.52-1ubuntu4.62.4.52-1ubuntu4.72.4.52-1ubuntu4.82.4.52-1ubuntu4.92.4.52-1ubuntu4.102.4.52-1ubuntu4.112.4.52-1ubuntu4.122.4.52-1ubuntu4.132.4.52-1ubuntu4.142.4.52-1ubuntu4.152.4.52-1ubuntu4.162.4.52-1ubuntu4.182.4.52-1ubuntu4.19
2.4.52-1ubuntu4.20
apache2
Ubuntu:24.04:LTS
 before 2.4.58-1ubuntu8.12, plus listed versions
2.4.57-2ubuntu22.4.57-2ubuntu32.4.58-1ubuntu12.4.58-1ubuntu22.4.58-1ubuntu6
Show 12 moreShow less
2.4.58-1ubuntu72.4.58-1ubuntu82.4.58-1ubuntu8.12.4.58-1ubuntu8.22.4.58-1ubuntu8.32.4.58-1ubuntu8.42.4.58-1ubuntu8.52.4.58-1ubuntu8.62.4.58-1ubuntu8.72.4.58-1ubuntu8.82.4.58-1ubuntu8.102.4.58-1ubuntu8.11
2.4.58-1ubuntu8.12
apache2
Ubuntu:25.10
 before 2.4.64-1ubuntu3.4, plus listed versions
2.4.63-1ubuntu12.4.63-1ubuntu32.4.64-1ubuntu22.4.64-1ubuntu32.4.64-1ubuntu3.22.4.64-1ubuntu3.3
2.4.64-1ubuntu3.4
apache2
Ubuntu:26.04:LTS
 before 2.4.66-2ubuntu2.1, plus listed versions
2.4.64-1ubuntu32.4.65-3ubuntu12.4.66-2ubuntu12.4.66-2ubuntu2
2.4.66-2ubuntu2.1
apache2
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 2.4.67-1.1
2.4.67-1.1
apache2
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-devel
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-event
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-manual
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-prefork
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-utils
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1
apache2-worker
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 2.4.66-160000.2.1
2.4.66-160000.2.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
affected, aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-29168 is a high vulnerability (CVSS 7.3) in Apache Http Server, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in apache2 2.4.67-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 2 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open