CVE-2026-56449

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.

This issue affects Apache HTTP Server version 2.4.68.

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.

This issue affects Apache HTTP Server version 2.4.68.

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.

This issue affects Apache HTTP Server version 2.4.68.

• CVE-2026-56153: fix mod_charset_lite heap overflow in finish_partial_char()
• CVE-2026-46729: fix mod_heartmonitor NULL pointer dereference in the heartbeat handler
• CVE-2026-56154: fix mod_rewrite use-after-free via %{LA-U:HTTP:...} lookahead
• CVE-2026-56449: fix mod_proxy_html out-of-bounds write in dump_content()
• CVE-2026-63292: fix mod_vhost_alias stack-based buffer overflow

• CVE-2026-56153: fix mod_charset_lite heap overflow in finish_partial_char
• CVE-2026-46729: fix mod_heartmonitor NULL pointer dereference in the unicast listener
• CVE-2026-56154: fix mod_rewrite use-after-free via LA-U/LA-F lookahead of HTTP headers
• CVE-2026-56449: fix mod_proxy_html crash in dump_content
• CVE-2026-63292: fix mod_vhost_alias stack buffer overflow with long host names

• CVE-2026-56153: fix mod_charset_lite heap overflow in finish_partial_char()
• CVE-2026-46729: fix mod_heartmonitor NULL pointer dereference in the heartbeat handler
• CVE-2026-56154: fix mod_rewrite use-after-free with LA-U/LA-F lookahead of HTTP headers
• CVE-2026-56449: fix mod_proxy_html out-of-bounds write in dump_content()
• CVE-2026-63292: fix mod_vhost_alias stack buffer overflow on overlong host names

• SECURITY UPDATE: out-of-bounds write in mod_charset_lite
  • debian/patches/CVE-2026-56153.patch: in finish_partial_char() in modules/filters/mod_charset_lite.c, stop accumulating a split multibyte character once ctx->saved reaches the size of ctx->buf so the next byte can no longer be written past the 8-byte buffer. Backported from httpd commit 6654234dcb395e07fd62255670356f84ec733195 (SVN r1938658).
  • CVE-2026-56153
• SECURITY UPDATE: use-after-free in mod_rewrite lookahead variables
  • debian/patches/CVE-2026-56154.patch: in lookup_variable() in modules/mappers/mod_rewrite.c, copy ctx->vary_this into the main request pool after an LA-U/LA-F lookahead sub-request so the Vary header name no longer points into the destroyed sub-request pool. Backported from httpd commit 6e4d1e614597109909dda495d235b6a1331d7beb (SVN r1938660).
  • CVE-2026-56154
• SECURITY UPDATE: out-of-bounds write in mod_proxy_html
  • debian/patches/CVE-2026-56449.patch: in pcomment() in modules/filters/mod_proxy_html.c, do not call dump_content() after writing an HTML comment so crafted response bodies can no longer trigger a write outside the output buffer. Backported from httpd commit c721d4e1cf5c142149509490015cef1a75715595 (SVN r1935931).
  • CVE-2026-56449
• SECURITY UPDATE: stack-based buffer overflow in mod_vhost_alias
  • debian/patches/CVE-2026-63292.patch: in vhost_alias_checkspace() and vhost_alias_interpolate() in modules/mappers/mod_vhost_alias.c, reject a single expanded segment (e.g. a Host header) of HUGE_STRING_LEN bytes or more with 414 instead of writing past the stack buffer. Backported from httpd commit 7ed3f91688b7a1e1ac48486fd2e5eeb2932e879f (SVN r1938675).
  • CVE-2026-63292
• SECURITY UPDATE: use-after-free in mod_http2 via session->bbtmp
  • debian/patches/CVE-2026-57941.patch: in modules/http2/h2_session.c, h2_c1_io.c and h2_mplx.c, use a per-call brigade instead of the shared session->bbtmp in on_send_data_cb() and ev_stream_closed(), remove buckets before feeding them, guard stream cleanup against re-entrancy with in_stream_cleanup/mplx_cleanup_done, and allocate the input/output iqueues from a separate pool. Backported from httpd commit d072ed8f06d66a30072227d61a2fc04ad9ae5c99 (SVN r1938665).
  • CVE-2026-57941

• CVE-2026-56153: mod_charset_lite: bound the partial character buffer in finish_partial_char
• CVE-2026-46729: mod_heartmonitor: validate the heartbeat POST body and query
• CVE-2026-56154: mod_rewrite: copy the lookahead Vary value out of the subrequest pool
• CVE-2026-56449: mod_proxy_html: don't dump content when printing a comment
• CVE-2026-63292: mod_vhost_alias: reject host name parts that do not fit the path buffer

• SECURITY UPDATE: mod_charset_lite: heap overflow in finish_partial_char
  • debian/patches/CVE-2026-56153.patch: mod_charset_lite: heap overflow in finish_partial_char
  • CVE-2026-56153
• SECURITY UPDATE: mod_heartmonitor: NULL pointer dereference on malformed heartbeat
  • debian/patches/CVE-2026-46729.patch: mod_heartmonitor: NULL pointer dereference on malformed heartbeat
  • CVE-2026-46729
• SECURITY UPDATE: mod_rewrite: use-after-free via LA-U lookahead variables
  • debian/patches/CVE-2026-56154.patch: mod_rewrite: use-after-free via LA-U lookahead variables
  • CVE-2026-56154
• SECURITY UPDATE: mod_proxy_html: out-of-bounds write in dump_content
  • debian/patches/CVE-2026-56449.patch: mod_proxy_html: out-of-bounds write in dump_content
  • CVE-2026-56449
• SECURITY UPDATE: mod_vhost_alias: stack overflow with oversized Host header
  • debian/patches/CVE-2026-63292.patch: mod_vhost_alias: stack overflow with oversized Host header
  • CVE-2026-63292
• SECURITY UPDATE: mod_proxy_uwsgi: response smuggling via Transfer-Encoding
  • debian/patches/CVE-2026-63718.patch: mod_proxy_uwsgi: response smuggling via Transfer-Encoding
  • CVE-2026-63718
• SECURITY UPDATE: mod_http2: use-after-free via shared session bbtmp re-entrancy
  • debian/patches/CVE-2026-57941.patch: mod_http2: use-after-free via shared session bbtmp re-entrancy
  • CVE-2026-57941

Limited RCE for some internal redirects to non-CGI files in CGI directories. (CVE-2026-42356) mod_dav shared lock overflow. (CVE-2026-42528) mod_heartmonitor denial of service. (CVE-2026-46729) mod_session: Session cookie not removed during internal redirect. (CVE-2026-47360) mod_auth_digest reauthentication attack. (CVE-2026-48005) mod_charset_lite: Heap overflow in finish_partial_char. (CVE-2026-56153) mod_rewrite use-after-free via %{LA-U:HTTP:...}. (CVE-2026-56154) mod_proxy_html: crash in dump_content. (CVE-2026-56449) mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy. (CVE-2026-57941) mod_dav_fs property database read access. (CVE-2026-58415) Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM. (CVE-2026-59685) mod_ssl SSLRequire allows .htaccess ap_expr file-function. (CVE-2026-59797) mod_proxy_ftp PASV address handling. (CVE-2026-63045) mod_vhost_alias stack overflow. (CVE-2026-63292) mod_xml2enc crash on charset conversion failure. (CVE-2026-63686) mod_proxy_uwsgi Transfer-Encoding response smuggling. (CVE-2026-63718) mod_auth_digest one-time-nonce replay attack. (CVE-2026-73636) mod_auth_digest DoS attack. (CVE-2026-73637) mod_userdir information disclosure. (CVE-2026-79768) mod_dav_fs namespace overflow. (CVE-2026-93546)

Root has patched CVE-2026-56449 in the apache2 package for Root:Debian:12. Multiple fixed versions available.