{"id":"CVE-2026-56449","aliases":["ALPINE-CVE-2026-56449","AZL-106794","BELL-CVE-2026-56449","BIT-apache-2026-56449","CLSA-2026-1791391794","CLSA-2026-1791392163","CLSA-2026-1791396690","CLSA-2026-1791447288","CLSA-2026-1791471297","CLSA-2026-1791482084","DEBIAN-CVE-2026-56449","EUVD-2026-90895","GHSA-76ff-8r4r-vpm8","MGASA-2026-0502","RHBA-2026:50158","RHSA-2026:74858","ROOT-OS-DEBIAN-12-CVE-2026-56449","UBUNTU-CVE-2026-56449"],"status":"published","title":"Apache HTTP Server: mod_proxy_html: crash in dump_content","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00571,"percentile":0.47694,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-10-01T16:06:24Z","modified":"2026-11-11T09:40:07Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.69-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.69-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.69-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.69-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"httpd","fixed_in":["2.4.69-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"apache2","fixed_in":["2.4.69-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"apache2","fixed_in":["2.4.69-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"apache2","fixed_in":["2.4.69-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.69"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.69-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.69-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-core","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-core-debuginfo","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-debuginfo","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-debugsource","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-devel","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-filesystem","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-manual","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-tools","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-tools-debuginfo","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ldap","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ldap-debuginfo","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_lua","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_lua-debuginfo","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_proxy_html","fixed_in":["1:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_proxy_html-debuginfo","fixed_in":["1:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_session","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_session-debuginfo","fixed_in":["0:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ssl","fixed_in":["1:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ssl-debuginfo","fixed_in":["1:2.4.63-13.el10_2.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"apache2","fixed_in":["2.4.68-1~deb12u1.aikido.15"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-apache2","fixed_in":["2.4.68-1~deb12u1.aikido.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apache2","fixed_in":["2.4.41-4ubuntu3.23+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"apache2","fixed_in":["2.4.52-1ubuntu4.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"apache2","fixed_in":["2.4.58-1ubuntu8.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"apache2","fixed_in":["2.4.68-1ubuntu6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"apache2","fixed_in":["2.4.66-2ubuntu2.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.54-r2"},{"fixed":"2.4.69-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.63-r0"},{"fixed":"2.4.69-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.56-r0"},{"fixed":"2.4.69-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.69"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-43.module_el8.5.0+2636+fb894a8d.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-39.module_el8.4.0+2638+bc4fa003.1.tuxcare.els22"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-64.module_el8+2637+9ff88676.tuxcare.els9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-ssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-suexec-custom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-suexec-pristine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"apache2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libapache2-mod-md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libapache2-mod-proxy-uwsgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-ssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-suexec-custom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-suexec-pristine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"apache2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libapache2-mod-md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libapache2-mod-proxy-uwsgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.57-2","2.4.57-3","2.4.58-1","2.4.59-1","2.4.59-1~deb10u1","2.4.59-1~deb11u1","2.4.59-1~deb12u1","2.4.59-2","2.4.60-1","2.4.61-1","2.4.61-1~deb11u1","2.4.61-1~deb12u1","2.4.62-1","2.4.62-1~deb11u1","2.4.62-1~deb11u2","2.4.62-1~deb12u1","2.4.62-1~deb12u2","2.4.62-2","2.4.62-3","2.4.62-4","2.4.62-5","2.4.62-6","2.4.63-1","2.4.64-1","2.4.65-1","2.4.65-1~deb11u1","2.4.65-1~deb12u1","2.4.65-2","2.4.65-3","2.4.66-1","2.4.66-1~deb11u1","2.4.66-1~deb12u1","2.4.66-1~deb12u2","2.4.66-1~deb13u1","2.4.66-1~deb13u2","2.4.66-2","2.4.66-3","2.4.66-4","2.4.66-5","2.4.66-6","2.4.66-7","2.4.66-8","2.4.67-1","2.4.67-1~deb11u1","2.4.67-1~deb11u2","2.4.67-1~deb11u3","2.4.67-1~deb12u1","2.4.67-1~deb12u2","2.4.67-1~deb12u3","2.4.67-1~deb13u1","2.4.67-1~deb13u2","2.4.67-1~deb13u3","2.4.67-2","2.4.68-1","2.4.68-1~deb12u1","2.4.68-1~deb13u1","2.4.68-2","2.4.69-1","2.4.69-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-1~deb13u1"}]}],"versions":["2.4.65-2","2.4.65-3","2.4.66-1","2.4.66-1~deb11u1","2.4.66-1~deb12u1","2.4.66-1~deb12u2","2.4.66-1~deb13u1","2.4.66-1~deb13u2","2.4.66-2","2.4.66-3","2.4.66-4","2.4.66-5","2.4.66-6","2.4.66-7","2.4.66-8","2.4.67-1","2.4.67-1~deb11u1","2.4.67-1~deb11u2","2.4.67-1~deb11u3","2.4.67-1~deb12u1","2.4.67-1~deb12u2","2.4.67-1~deb12u3","2.4.67-1~deb13u1","2.4.67-1~deb13u2","2.4.67-1~deb13u3","2.4.67-2","2.4.68-1","2.4.68-1~deb12u1","2.4.68-1~deb13u1","2.4.68-2"]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-1"}]}],"versions":["2.4.65-2","2.4.65-3","2.4.66-1","2.4.66-1~deb11u1","2.4.66-1~deb12u1","2.4.66-1~deb12u2","2.4.66-1~deb13u1","2.4.66-1~deb13u2","2.4.66-2","2.4.66-3","2.4.66-4","2.4.66-5","2.4.66-6","2.4.66-7","2.4.66-8","2.4.67-1","2.4.67-1~deb11u1","2.4.67-1~deb11u2","2.4.67-1~deb11u3","2.4.67-1~deb12u1","2.4.67-1~deb12u2","2.4.67-1~deb12u3","2.4.67-1~deb13u1","2.4.67-1~deb13u2","2.4.67-1~deb13u3","2.4.67-2","2.4.68-1","2.4.68-1~deb12u1","2.4.68-1~deb13u1","2.4.68-2","2.4.69-1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.69-1.mga10"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.63-13.el10_2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.69-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Root:Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.68-1~deb12u1.aikido.15"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.68-1~deb12u1.aikido.15"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+esm10"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4","2.4.41-4ubuntu3.5","2.4.41-4ubuntu3.6","2.4.41-4ubuntu3.7","2.4.41-4ubuntu3.8","2.4.41-4ubuntu3.9","2.4.41-4ubuntu3.10","2.4.41-4ubuntu3.11","2.4.41-4ubuntu3.12","2.4.41-4ubuntu3.13","2.4.41-4ubuntu3.14","2.4.41-4ubuntu3.15","2.4.41-4ubuntu3.16","2.4.41-4ubuntu3.17","2.4.41-4ubuntu3.19","2.4.41-4ubuntu3.20","2.4.41-4ubuntu3.21","2.4.41-4ubuntu3.23","2.4.41-4ubuntu3.23+esm2","2.4.41-4ubuntu3.23+esm3","2.4.41-4ubuntu3.23+esm4","2.4.41-4ubuntu3.23+esm5","2.4.41-4ubuntu3.23+esm6","2.4.41-4ubuntu3.23+esm7","2.4.41-4ubuntu3.23+esm8","2.4.41-4ubuntu3.23+esm9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1ubuntu4.26"}]}],"versions":["2.4.48-3.1ubuntu3","2.4.48-3.1ubuntu4","2.4.51-2ubuntu1","2.4.52-1ubuntu1","2.4.52-1ubuntu2","2.4.52-1ubuntu4","2.4.52-1ubuntu4.1","2.4.52-1ubuntu4.2","2.4.52-1ubuntu4.3","2.4.52-1ubuntu4.4","2.4.52-1ubuntu4.5","2.4.52-1ubuntu4.6","2.4.52-1ubuntu4.7","2.4.52-1ubuntu4.8","2.4.52-1ubuntu4.9","2.4.52-1ubuntu4.10","2.4.52-1ubuntu4.11","2.4.52-1ubuntu4.12","2.4.52-1ubuntu4.13","2.4.52-1ubuntu4.14","2.4.52-1ubuntu4.15","2.4.52-1ubuntu4.16","2.4.52-1ubuntu4.18","2.4.52-1ubuntu4.19","2.4.52-1ubuntu4.20","2.4.52-1ubuntu4.21","2.4.52-1ubuntu4.23","2.4.52-1ubuntu4.24","2.4.52-1ubuntu4.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1ubuntu8.18"}]}],"versions":["2.4.57-2ubuntu2","2.4.57-2ubuntu3","2.4.58-1ubuntu1","2.4.58-1ubuntu2","2.4.58-1ubuntu6","2.4.58-1ubuntu7","2.4.58-1ubuntu8","2.4.58-1ubuntu8.1","2.4.58-1ubuntu8.2","2.4.58-1ubuntu8.3","2.4.58-1ubuntu8.4","2.4.58-1ubuntu8.5","2.4.58-1ubuntu8.6","2.4.58-1ubuntu8.7","2.4.58-1ubuntu8.8","2.4.58-1ubuntu8.10","2.4.58-1ubuntu8.11","2.4.58-1ubuntu8.12","2.4.58-1ubuntu8.13","2.4.58-1ubuntu8.15","2.4.58-1ubuntu8.16","2.4.58-1ubuntu8.17"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.68-1ubuntu6.1"}]}],"versions":["2.4.66-2ubuntu2","2.4.68-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-2ubuntu2.7"}]}],"versions":["2.4.64-1ubuntu3","2.4.65-3ubuntu1","2.4.66-2ubuntu1","2.4.66-2ubuntu2","2.4.66-2ubuntu2.1","2.4.66-2ubuntu2.2","2.4.66-2ubuntu2.4","2.4.66-2ubuntu2.5","2.4.66-2ubuntu2.6"]}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/18","tags":["Mailing List","Third Party Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56449","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-76ff-8r4r-vpm8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56449","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56449","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1791391794.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63292","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1791392163.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1791396690.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791447288.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57941","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791471297.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1791482084.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63718","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56449.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56449","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0502.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36432","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/11","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/14","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/15","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/16","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/17","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/18","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/19","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/20","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/21","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/22","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/23","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/24","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/25","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/26","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/27","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/28","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/29","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/01/30","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2026:50158","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_50158.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56449","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74858","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47360","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42356","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48005","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73636","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58415","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56153","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63045","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63292","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42528","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63686","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73637","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79768","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63718","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59797","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57941","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56154","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74858.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42356","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/11","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544828","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42528","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/12","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46729","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/13","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544884","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47360","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/14","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48005","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/15","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56153","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/16","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56154","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/17","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57941","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/19","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58415","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58415","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/20","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544833","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59797","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/22","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63045","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/23","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544832","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63292","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/24","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/25","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544781","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63718","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/26","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544849","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73636","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/27","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544814","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73637","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/28","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79768","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/29","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544798","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93546","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/30","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-56449","tags":["report"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-56449","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9016-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56449","title":"Apache HTTP Server: mod_proxy_html: crash in dump_content","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T16:06:24.05Z","modified":"2026-10-21T07:59:33.661Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-90895","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T16:06:24Z","modified":"2026-10-21T07:59:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:40.152045Z"}],"ghsa":[{"id":"GHSA-76ff-8r4r-vpm8","title":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP...","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.","status":"published","published":"2026-10-01T18:32:45Z","modified":"2026-10-01T21:33:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:12:41.838372Z"}],"nvd":[{"id":"CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T17:17:26.733Z","modified":"2026-10-21T08:16:44.203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:53.41762Z"}],"osv":[{"id":"ALPINE-CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T17:17:26.733Z","modified":"2026-10-23T18:30:02.579132592Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-56449","status":"published","published":"2026-10-03T06:05:05.35396Z","modified":"2026-10-05T07:15:03.119209727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56449","title":"Apache HTTP Server: mod_proxy_html: crash in dump_content","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T16:06:24.05Z","modified":"2026-11-05T21:32:23.906657954Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-05T22:00:34.245765Z"},{"id":"DEBIAN-CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.    This issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T17:17:26.733Z","modified":"2026-10-23T17:47:24.449082908Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"RHBA-2026:50158","title":"Red Hat Bug Fix Advisory: httpd bug fix and enhancement update","status":"published","published":"2026-10-10T10:04:02Z","modified":"2026-10-12T10:03:10Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2026:74858","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-03T10:16:58Z","modified":"2026-10-15T10:26:57Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T17:17:00Z","modified":"2026-11-11T09:40:07.532418204Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-11T10:02:12.477481Z"},{"id":"AZL-106794","title":"CVE-2026-56449 affecting package httpd for versions less than 2.4.69-1","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-01T17:17:26Z","modified":"2026-11-02T14:16:23.4377926Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"BIT-apache-2026-56449","title":"Apache HTTP Server: mod_proxy_html: crash in dump_content","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server version 2.4.68.","status":"published","published":"2026-10-06T11:40:53.28Z","modified":"2026-10-22T09:00:02.415717475Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2026-1791391794","title":"httpd: Fix of 5 CVEs","description":"- CVE-2026-56153: fix mod_charset_lite heap overflow in finish_partial_char()\n- CVE-2026-46729: fix mod_heartmonitor NULL pointer dereference in the heartbeat\n  handler\n- CVE-2026-56154: fix mod_rewrite use-after-free via %{LA-U:HTTP:...} lookahead\n- CVE-2026-56449: fix mod_proxy_html out-of-bounds write in dump_content()\n- CVE-2026-63292: fix mod_vhost_alias stack-based buffer overflow","status":"published","published":"2026-10-07T16:50:11Z","modified":"2026-10-26T09:43:28.731158353Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791392163","title":"httpd: Fix of 5 CVEs","description":"- CVE-2026-56153: fix mod_charset_lite heap overflow in finish_partial_char\n- CVE-2026-46729: fix mod_heartmonitor NULL pointer dereference in the unicast\n  listener\n- CVE-2026-56154: fix mod_rewrite use-after-free via LA-U/LA-F lookahead of\n  HTTP headers\n- CVE-2026-56449: fix mod_proxy_html crash in dump_content\n- CVE-2026-63292: fix mod_vhost_alias stack buffer overflow with long host\n  names","status":"published","published":"2026-10-07T16:56:19Z","modified":"2026-10-26T09:43:25.136821729Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791396690","title":"httpd: Fix of 5 CVEs","description":"- CVE-2026-56153: fix mod_charset_lite heap overflow in finish_partial_char()\n- CVE-2026-46729: fix mod_heartmonitor NULL pointer dereference in the\n  heartbeat handler\n- CVE-2026-56154: fix mod_rewrite use-after-free with LA-U/LA-F lookahead of\n  HTTP headers\n- CVE-2026-56449: fix mod_proxy_html out-of-bounds write in dump_content()\n- CVE-2026-63292: fix mod_vhost_alias stack buffer overflow on overlong host\n  names","status":"published","published":"2026-10-07T18:11:45Z","modified":"2026-10-26T09:43:22.255419175Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791447288","title":"Fix of 5 CVEs","description":"   * SECURITY UPDATE: out-of-bounds write in mod_charset_lite\n     - debian/patches/CVE-2026-56153.patch: in finish_partial_char() in\n       modules/filters/mod_charset_lite.c, stop accumulating a split\n       multibyte character once ctx-\u003esaved reaches the size of ctx-\u003ebuf so\n       the next byte can no longer be written past the 8-byte buffer.\n       Backported from httpd commit 6654234dcb395e07fd62255670356f84ec733195\n       (SVN r1938658).\n     - CVE-2026-56153\n   * SECURITY UPDATE: use-after-free in mod_rewrite lookahead variables\n     - debian/patches/CVE-2026-56154.patch: in lookup_variable() in\n       modules/mappers/mod_rewrite.c, copy ctx-\u003evary_this into the main\n       request pool after an LA-U/LA-F lookahead sub-request so the Vary\n       header name no longer points into the destroyed sub-request pool.\n       Backported from httpd commit 6e4d1e614597109909dda495d235b6a1331d7beb\n       (SVN r1938660).\n     - CVE-2026-56154\n   * SECURITY UPDATE: out-of-bounds write in mod_proxy_html\n     - debian/patches/CVE-2026-56449.patch: in pcomment() in\n       modules/filters/mod_proxy_html.c, do not call dump_content() after\n       writing an HTML comment so crafted response bodies can no longer\n       trigger a write outside the output buffer. Backported from httpd\n       commit c721d4e1cf5c142149509490015cef1a75715595 (SVN r1935931).\n     - CVE-2026-56449\n   * SECURITY UPDATE: stack-based buffer overflow in mod_vhost_alias\n     - debian/patches/CVE-2026-63292.patch: in vhost_alias_checkspace()\n       and vhost_alias_interpolate() in modules/mappers/mod_vhost_alias.c,\n       reject a single expanded segment (e.g. a Host header) of\n       HUGE_STRING_LEN bytes or more with 414 instead of writing past the\n       stack buffer. Backported from httpd commit\n       7ed3f91688b7a1e1ac48486fd2e5eeb2932e879f (SVN r1938675).\n     - CVE-2026-63292\n   * SECURITY UPDATE: use-after-free in mod_http2 via session-\u003ebbtmp\n     - debian/patches/CVE-2026-57941.patch: in modules/http2/h2_session.c,\n       h2_c1_io.c and h2_mplx.c, use a per-call brigade instead of the\n       shared session-\u003ebbtmp in on_send_data_cb() and ev_stream_closed(),\n       remove buckets before feeding them, guard stream cleanup against\n       re-entrancy with in_stream_cleanup/mplx_cleanup_done, and allocate\n       the input/output iqueues from a separate pool. Backported from\n       httpd commit d072ed8f06d66a30072227d61a2fc04ad9ae5c99\n       (SVN r1938665).\n     - CVE-2026-57941","status":"published","published":"2026-10-08T08:15:07Z","modified":"2026-10-26T09:43:41.276393626Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791471297","title":"httpd: Fix of 5 CVEs","description":"- CVE-2026-56153: mod_charset_lite: bound the partial character buffer in\n  finish_partial_char\n- CVE-2026-46729: mod_heartmonitor: validate the heartbeat POST body and query\n- CVE-2026-56154: mod_rewrite: copy the lookahead Vary value out of the\n  subrequest pool\n- CVE-2026-56449: mod_proxy_html: don't dump content when printing a comment\n- CVE-2026-63292: mod_vhost_alias: reject host name parts that do not fit the\n  path buffer","status":"published","published":"2026-10-09T07:31:55Z","modified":"2026-10-26T09:43:44.402014392Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791482084","title":"Fix of 7 CVEs","description":"   * SECURITY UPDATE: mod_charset_lite: heap overflow in finish_partial_char\n     - debian/patches/CVE-2026-56153.patch: mod_charset_lite: heap overflow in finish_partial_char\n     - CVE-2026-56153\n   * SECURITY UPDATE: mod_heartmonitor: NULL pointer dereference on malformed heartbeat\n     - debian/patches/CVE-2026-46729.patch: mod_heartmonitor: NULL pointer dereference on malformed heartbeat\n     - CVE-2026-46729\n   * SECURITY UPDATE: mod_rewrite: use-after-free via LA-U lookahead variables\n     - debian/patches/CVE-2026-56154.patch: mod_rewrite: use-after-free via LA-U lookahead variables\n     - CVE-2026-56154\n   * SECURITY UPDATE: mod_proxy_html: out-of-bounds write in dump_content\n     - debian/patches/CVE-2026-56449.patch: mod_proxy_html: out-of-bounds write in dump_content\n     - CVE-2026-56449\n   * SECURITY UPDATE: mod_vhost_alias: stack overflow with oversized Host header\n     - debian/patches/CVE-2026-63292.patch: mod_vhost_alias: stack overflow with oversized Host header\n     - CVE-2026-63292\n   * SECURITY UPDATE: mod_proxy_uwsgi: response smuggling via Transfer-Encoding\n     - debian/patches/CVE-2026-63718.patch: mod_proxy_uwsgi: response smuggling via Transfer-Encoding\n     - CVE-2026-63718\n   * SECURITY UPDATE: mod_http2: use-after-free via shared session bbtmp re-entrancy\n     - debian/patches/CVE-2026-57941.patch: mod_http2: use-after-free via shared session bbtmp re-entrancy\n     - CVE-2026-57941","status":"published","published":"2026-10-08T23:17:53Z","modified":"2026-10-26T09:43:46.125847182Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0502","title":"Updated apache package fixes security vulnerabilities","description":"Limited RCE for some internal redirects to non-CGI files in CGI\ndirectories. (CVE-2026-42356)\nmod_dav shared lock overflow. (CVE-2026-42528)\nmod_heartmonitor denial of service. (CVE-2026-46729)\nmod_session: Session cookie not removed during internal redirect.\n(CVE-2026-47360)\nmod_auth_digest reauthentication attack. (CVE-2026-48005)\nmod_charset_lite: Heap overflow in finish_partial_char. (CVE-2026-56153)\nmod_rewrite use-after-free via %{LA-U:HTTP:...}. (CVE-2026-56154)\nmod_proxy_html: crash in dump_content. (CVE-2026-56449)\nmod_http2 use-after-free / wild write via shared session-\u003ebbtmp\nre-entrancy. (CVE-2026-57941)\nmod_dav_fs property database read access. (CVE-2026-58415)\nOut-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on\nCASE_BLIND_FILESYSTEM. (CVE-2026-59685)\nmod_ssl SSLRequire allows .htaccess ap_expr file-function.\n(CVE-2026-59797)\nmod_proxy_ftp PASV address handling. (CVE-2026-63045)\nmod_vhost_alias stack overflow. (CVE-2026-63292)\nmod_xml2enc crash on charset conversion failure. (CVE-2026-63686)\nmod_proxy_uwsgi Transfer-Encoding response smuggling. (CVE-2026-63718)\nmod_auth_digest one-time-nonce replay attack. (CVE-2026-73636)\nmod_auth_digest DoS attack. (CVE-2026-73637)\nmod_userdir information disclosure. (CVE-2026-79768)\nmod_dav_fs namespace overflow. (CVE-2026-93546)\n","status":"published","published":"2026-10-14T02:42:28Z","modified":"2026-10-14T02:45:03.446097521Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-56449","title":"CVE-2026-56449 in apache2 - Patched by Root","description":"Root has patched CVE-2026-56449 in the apache2 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-20T04:28:23Z","modified":"2026-10-20T05:15:04.317988188Z","updated_at":"2026-11-02T15:53:32.570806Z"}]}}