CVE-2026-43951

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-42536)

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.(CVE-2026-43951)

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

This issue affects Apache HTTP Server: from through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44119)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.(CVE-2026-48913)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-42536)

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.(CVE-2026-43951)

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

This issue affects Apache HTTP Server: from through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44119)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.(CVE-2026-48913)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.(CVE-2026-43951)

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

This issue affects Apache HTTP Server: from through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44119)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.(CVE-2026-43951)

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

• httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913)

• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

• address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:Rocky Linux-188008)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

• Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072)

• httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)

• httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

• httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

• httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)

• httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

• httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)

• httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535)

• httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)

• httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

• httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges (CVE-2026-44119)

Bug Fix(es) and Enhancement(s):

• address Moderate severity issues from httpd 2.4.68 [rhel-9.8.z] (JIRA:Rocky Linux-184520)

• mod_proxy_html regression in CVE-2026-34355 fix [rhel-9.8.z] (JIRA:Rocky Linux-192752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

• httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

• httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

• httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)

• httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

• httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)

• httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)

• httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

• mod_proxy_html regression in CVE-2026-34355 fix [rhel-8.10.z] (JIRA:Rocky Linux-192751)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

• httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913)

• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

• address CVE-2026-43951 and CVE-2026-48913 in mod_http2 [rhel-9] (JIRA:Rocky Linux-190583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
• httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
• httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
• httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
• httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
• httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
• httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

Bug Fix(es) and Enhancement(s):

• address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

• httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913)
• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

• address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
• Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072)
• httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)
• httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
• httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
• httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
• httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
• httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)
• httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535)
• httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
• httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)
• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)
• httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges (CVE-2026-44119)

Bug Fix(es) and Enhancement(s):

• address Moderate severity issues from httpd 2.4.68 [almalinux-9.8.z] (JIRA:AlmaLinux-184520)
• mod_proxy_html regression in CVE-2026-34355 fix [almalinux-9.8.z] (JIRA:AlmaLinux-192752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
• httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
• httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
• httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
• httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
• httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)
• httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
• httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)
• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

• mod_proxy_html regression in CVE-2026-34355 fix [almalinux-8.10.z] (JIRA:AlmaLinux-192751)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

• httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913)
• httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

• address CVE-2026-43951 and CVE-2026-48913 in mod_http2 [almalinux-9] (JIRA:AlmaLinux-190583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

• CVE-2026-43951: fix Content-Language array iteration in merge_response_headers (modules/http/http_filters.c) and create_response (modules/http2/h2_c2_filter.c); the http2 hunk is inert in this --disable-http2 build and is kept for upstream fidelity

• CVE-2026-43951: fix mod_headers/mod_mime out-of-bounds read in merge_response_headers content-language iteration
• CVE-2026-44119: fix improper privilege management allowing .htaccess authors to invoke file functions in restricted contexts
• CVE-2026-44185: fix mod_ssl OCSP buffer over-read in ssl_util_ocsp send_request
• CVE-2026-44186: fix mod_proxy_ftp infinite loop on crafted backend FTP response
• CVE-2026-44631: fix ap_regname buffer underwrite via crafted named capture in configuration regex

• CVE-2026-43951: fix mod_headers/mod_mime out-of-bounds read in merge_response_headers content-language iteration
• CVE-2026-44119: fix improper privilege management allowing .htaccess authors to invoke file functions in restricted contexts
• CVE-2026-44185: fix mod_ssl OCSP buffer over-read in ssl_util_ocsp send_request
• CVE-2026-44186: fix mod_proxy_ftp infinite loop on crafted backend FTP response
• CVE-2026-44631: fix ap_regname buffer underwrite via crafted named capture in configuration regex

• CVE-2026-43951: fix http_filters out-of-bounds read in merge_response_headers language iteration
• CVE-2026-44119: restrict ap_expr per-directory file functions centrally
• CVE-2026-44185: fix mod_ssl OCSP send_request buffer over-read
• CVE-2026-44186: fix mod_proxy_ftp infinite loop in FTP response iteration
• CVE-2026-44631: fix util_pcre ap_regname buffer underwrite via crafted regex captures

• CVE-2026-43951: fix out-of-bounds read when merging duplicate Content-Language response headers

The updated packages fix security vulnerabilities: Apache HTTP Server: mod_ldap per-dir use-after-free. (CVE-2026-29167) Apache HTTP Server: mod_proxy_ftp XSS. (CVE-2026-29170) Apache HTTP Server: mod_proxy_html buffer overflow. (CVE-2026-34355) Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow. (CVE-2026-34356) Apache HTTP Server: mod_dav_fs protected directory access. (CVE-2026-42535) Apache HTTP Server: mod_xml2enc heap overflow. (CVE-2026-42536) Apache HTTP Server: OOB Read in merge_response_headers can cause crash. (CVE-2026-43951) Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules. (CVE-2026-44119) Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP send_request. (CVE-2026-44185) Apache HTTP Server: Loop in proxy_ftp_handler in mod_proxy_ftp. (CVE-2026-44186) Apache HTTP Server: Heap Underflow in ap_regname via Signed Char Overflow. (CVE-2026-44631) Apache HTTP Server: mod_http2 memory corruption when file handles exhausted. (CVE-2026-48913) Apache HTTP Server: mod_http2 denial of service. (CVE-2026-49975)

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Root has patched CVE-2026-43951 in the apache2 package for Root:Debian:13. Multiple fixed versions available.

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

This update for apache2 fixes the following issues

• CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
• CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
• CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
• CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
• CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
• CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
• CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
• CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
• CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Non security issue:

• Update to 2.4.66 (jsc#PED-16334).

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-29167)

It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170)

It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34355)

It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34356)

It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535)

It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42536)

It was discovered that Apache HTTP Server incorrectly handled response headers when multiple content languages were configured. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43951)

It was discovered that Apache HTTP Server incorrectly restricted certain file functions in expressions within .htaccess files. A local attacker with .htaccess write access could possibly use this issue to obtain sensitive information. (CVE-2026-44119)

It was discovered that Apache HTTP Server's mod_ssl module incorrectly handled OCSP responses from an attacker-controlled server. A remote attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-44185)

It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled responses from an attacker-controlled backend FTP server. A remote attacker could possibly use this issue to cause Apache HTTP Server to stop responding, resulting in a denial of service. (CVE-2026-44186)

It was discovered that Apache HTTP Server incorrectly handled crafted regular expressions in the server configuration. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. (CVE-2026-44631)

It was discovered that Apache HTTP Server's mod_http2 module had a use-after-free vulnerability when file handles were exhausted. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-48913)

Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in mod_authn_socache. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33007)

Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apache HTTP Server had an HTTP response splitting vulnerability in multiple modules when used with untrusted or compromised backend servers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-33523)

Elhanan Haenel discovered that Apache HTTP Server incorrectly handled certain memory operations in mod_proxy_ajp. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33857)

Tianshuo Han and Jérôme Djouder discovered that Apache HTTP Server incorrectly handled certain string operations in mod_proxy_ajp. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-34032)

It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-34355)

It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-34356)

It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535)

It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-42536)

It was discovered that Apache HTTP Server incorrectly handled response headers when multiple content languages were configured. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43951)

It was discovered that Apache HTTP Server incorrectly restricted certain file functions in expressions within .htaccess files. A local attacker with .htaccess write access could possibly use this issue to obtain sensitive information. (CVE-2026-44119)

It was discovered that Apache HTTP Server's mod_ssl module incorrectly handled OCSP responses from an attacker-controlled server. A remote attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-44185)

It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled responses from an attacker-controlled backend FTP server. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-44186)

It was discovered that Apache HTTP Server incorrectly handled crafted regular expressions in the server configuration. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44631)

It was discovered that Apache HTTP Server's mod_http2 module had a use-after-free vulnerability when file handles were exhausted. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-48913)