CVE-2026-29167

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-42536)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-42536)

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

This issue affects Apache HTTP Server: from through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44119)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-42536)

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.(CVE-2026-43951)

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

This issue affects Apache HTTP Server: from through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44119)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.(CVE-2026-48913)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-42536)

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.(CVE-2026-43951)

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

This issue affects Apache HTTP Server: from through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44119)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.(CVE-2026-48913)

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

• CVE-2026-29167: fix mod_ldap use-after-free with per-directory LDAP config
• CVE-2026-29170: fix mod_proxy_ftp XSS in generated FTP directory listings
• CVE-2026-34355: fix mod_proxy_html buffer overflow via ap_varbuf API migration
• CVE-2026-34356: fix mod_proxy heap buffer overflow in ProxyPassReverseCookie* handling
• CVE-2026-42535: fix mod_dav_fs path handling allowing manipulation of DAV property databases
• CVE-2026-42536: fix mod_xml2enc heap buffer overflow in xml2StartParse accounting

• CVE-2026-29167: fix mod_ldap use-after-free with per-directory LDAP config
• CVE-2026-29170: fix mod_proxy_ftp XSS in generated FTP directory listings
• CVE-2026-34355: fix mod_proxy_html buffer overflow via ap_varbuf API migration
• CVE-2026-34356: fix mod_proxy heap buffer overflow in ProxyPassReverseCookie* handling
• CVE-2026-42535: fix mod_dav_fs path handling allowing manipulation of DAV property databases
• CVE-2026-42536: fix mod_xml2enc heap buffer overflow in xml2StartParse accounting

• CVE-2026-29167: fix mod_ldap use-after-free with per-directory LDAP config
• CVE-2026-29170: fix mod_proxy_ftp XSS in generated FTP directory listings
• CVE-2026-34355: fix mod_proxy_html buffer overflow via ap_varbuf API migration
• CVE-2026-34356: fix mod_proxy heap buffer overflow in ProxyPassReverseCookie* handling
• CVE-2026-42535: fix mod_dav_fs path handling allowing manipulation of DAV property databases
• CVE-2026-42536: fix mod_xml2enc heap buffer overflow in xml2StartParse accounting

• CVE-2026-29167: mod_ldap use-after-free in per-directory config, deep-copy client_certs into the connection pool
• CVE-2026-34356: mod_proxy heap buffer overflow in ap_proxy_cookie_reverse_map(), reset newpath/newdomain state on duplicate path=/domain= cookie attributes from a malicious backend

• SECURITY UPDATE: use-after-free in mod_ldap per-directory client certificate configuration
  • debian/patches/CVE-2026-29167.patch: deep-copy the per-directory client_certs array (each cert path and password) into the connection pool in uldap_connection_find() so the cached connection no longer retains pointers into the short-lived per-directory config pool in modules/ldap/util_ldap.c.
  • CVE-2026-29167
• SECURITY UPDATE: buffer overflow in mod_proxy_html with an untrusted backend response
  • debian/patches/CVE-2026-34355.patch: replace the hand-managed preserve()/pappend() output buffer with the bounds-checked ap_varbuf API (ap_varbuf_grow, ap_varbuf_strmemcat, ap_varbuf_regsub) for the CDATA, element and event URL rewrites so an oversized substitution can no longer overflow the buffer in modules/filters/mod_proxy_html.c.
  • CVE-2026-34355
• SECURITY UPDATE: heap buffer overflow in mod_proxy ProxyPassReverseCookie handling with a malicious backend response
  • debian/patches/CVE-2026-34356.patch: reset newpath/pdiff and newdomain/ddiff for each path= and domain= cookie attribute in ap_proxy_cookie_reverse_map() so a duplicate attribute can no longer reuse a stale length offset and overflow the rewritten cookie buffer in modules/proxy/proxy_util.c.
  • CVE-2026-34356

• CVE-2026-42536: mod_xml2enc: fix buffer accounting in fix_skipto
• CVE-2026-29167: util_ldap: deep-copy client certs into connection pool
• CVE-2026-42535: mod_dav_fs: deny access to the state directory

• CVE-2026-29167: mod_ldap: use-after-free in per-directory configuration — deep-copy the client certificate list (and referenced path/password strings) into the connection pool instead of a shallow header copy
• CVE-2026-29170: mod_proxy_ftp: cross-site scripting in the generated FTP directory listing — escape href filenames with ap_os_escape_path() wrapped in ap_escape_html() instead of ap_escape_uri()
• CVE-2026-34355: mod_proxy_html: heap buffer overflow reachable from an untrusted backend — replace hand-rolled buffer management with the ap_varbuf API
• CVE-2026-42535: mod_dav_fs: deny WebDAV access to/within the .DAV state directory in dav_fs_get_resource()
• CVE-2026-42536: mod_xml2enc: heap buffer overflow in fix_skipto — keep the buffer length (bblen) accounting in sync when advancing the buffer

• CVE-2026-29167: mod_ldap: use-after-free in per-directory configuration — deep-copy the client certificate list (and referenced path/password strings) into the connection pool instead of a shallow header copy
• CVE-2026-29170: mod_proxy_ftp: cross-site scripting in the generated FTP directory listing — escape href filenames with ap_os_escape_path() wrapped in ap_escape_html() instead of ap_escape_uri()
• CVE-2026-34355: mod_proxy_html: heap buffer overflow reachable from an untrusted backend — replace hand-rolled buffer management with the ap_varbuf API
• CVE-2026-42535: mod_dav_fs: deny WebDAV access to/within the .DAV state directory in dav_fs_get_resource()
• CVE-2026-42536: mod_xml2enc: heap buffer overflow in fix_skipto — keep the buffer length (bblen) accounting in sync when advancing the buffer

• SECURITY UPDATE: mod_xml2enc heap-based buffer overflow via xml2StartParse with untrusted content
  • debian/patches/CVE-2026-42536.patch: mod_xml2enc heap-based buffer overflow via xml2StartParse with untrusted content
  • CVE-2026-42536
• SECURITY UPDATE: mod_proxy_ftp cross-site scripting in HTML directory list generation
  • debian/patches/CVE-2026-29170.patch: mod_proxy_ftp cross-site scripting in HTML directory list generation
  • CVE-2026-29170
• SECURITY UPDATE: mod_ldap use-after-free in per-directory configuration
  • debian/patches/CVE-2026-29167.patch: mod_ldap use-after-free in per-directory configuration
  • CVE-2026-29167
• SECURITY UPDATE: mod_dav_fs path handling allows direct manipulation of trusted DAV property databases
  • debian/patches/CVE-2026-42535.patch: mod_dav_fs path handling allows direct manipulation of trusted DAV property databases
  • CVE-2026-42535
• SECURITY UPDATE: mod_proxy_html buffer overflow allowing attack by an untrusted backend
  • debian/patches/CVE-2026-34355.patch: mod_proxy_html buffer overflow allowing attack by an untrusted backend
  • CVE-2026-34355

• SECURITY UPDATE: mod_xml2enc heap-based buffer overflow via xml2StartParse with untrusted content
  • debian/patches/CVE-2026-42536.patch: mod_xml2enc heap-based buffer overflow via xml2StartParse with untrusted content
  • CVE-2026-42536
• SECURITY UPDATE: mod_proxy_ftp cross-site scripting in HTML directory list generation
  • debian/patches/CVE-2026-29170.patch: mod_proxy_ftp cross-site scripting in HTML directory list generation
  • CVE-2026-29170
• SECURITY UPDATE: mod_ldap use-after-free in per-directory configuration
  • debian/patches/CVE-2026-29167.patch: mod_ldap use-after-free in per-directory configuration
  • CVE-2026-29167
• SECURITY UPDATE: mod_dav_fs path handling allows direct manipulation of trusted DAV property databases
  • debian/patches/CVE-2026-42535.patch: mod_dav_fs path handling allows direct manipulation of trusted DAV property databases
  • CVE-2026-42535
• SECURITY UPDATE: mod_proxy_html buffer overflow allowing attack by an untrusted backend
  • debian/patches/CVE-2026-34355.patch: mod_proxy_html buffer overflow allowing attack by an untrusted backend
  • CVE-2026-34355

The updated packages fix security vulnerabilities: Apache HTTP Server: mod_ldap per-dir use-after-free. (CVE-2026-29167) Apache HTTP Server: mod_proxy_ftp XSS. (CVE-2026-29170) Apache HTTP Server: mod_proxy_html buffer overflow. (CVE-2026-34355) Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow. (CVE-2026-34356) Apache HTTP Server: mod_dav_fs protected directory access. (CVE-2026-42535) Apache HTTP Server: mod_xml2enc heap overflow. (CVE-2026-42536) Apache HTTP Server: OOB Read in merge_response_headers can cause crash. (CVE-2026-43951) Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules. (CVE-2026-44119) Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP send_request. (CVE-2026-44185) Apache HTTP Server: Loop in proxy_ftp_handler in mod_proxy_ftp. (CVE-2026-44186) Apache HTTP Server: Heap Underflow in ap_regname via Signed Char Overflow. (CVE-2026-44631) Apache HTTP Server: mod_http2 memory corruption when file handles exhausted. (CVE-2026-48913) Apache HTTP Server: mod_http2 denial of service. (CVE-2026-49975)

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Root has patched CVE-2026-29167 in the apache2 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-29167 in the apache2 package for Root:Debian:13. Multiple fixed versions available.

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

This update for apache2 fixes the following issues

• CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
• CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
• CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
• CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
• CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
• CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
• CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
• CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
• CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Non security issue:

• Update to 2.4.66 (jsc#PED-16334).

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

This update for apache2 fixes the following issues

• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-29167)

It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170)

It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34355)

It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34356)

It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535)

It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42536)

It was discovered that Apache HTTP Server incorrectly handled response headers when multiple content languages were configured. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43951)

It was discovered that Apache HTTP Server incorrectly restricted certain file functions in expressions within .htaccess files. A local attacker with .htaccess write access could possibly use this issue to obtain sensitive information. (CVE-2026-44119)

It was discovered that Apache HTTP Server's mod_ssl module incorrectly handled OCSP responses from an attacker-controlled server. A remote attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-44185)

It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled responses from an attacker-controlled backend FTP server. A remote attacker could possibly use this issue to cause Apache HTTP Server to stop responding, resulting in a denial of service. (CVE-2026-44186)

It was discovered that Apache HTTP Server incorrectly handled crafted regular expressions in the server configuration. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. (CVE-2026-44631)

It was discovered that Apache HTTP Server's mod_http2 module had a use-after-free vulnerability when file handles were exhausted. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-48913)

It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-29167)

It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170)

Nitescu Lucian discovered that Apache HTTP Server's mod_auth_digest module was vulnerable to a timing attack. A remote attacker could possibly use this issue to bypass Digest authentication. (CVE-2026-33006)