DeutschShown in its original language — a full translation is planned for a future version.
Apache HTTP Server: Mehrere Schwachstellen
view advisory published 2026-10-01
Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Programmcode auszuführen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zustände zu verursachen.
01
describes (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-93546US | — | — | ||
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a dir… | ||||
| CVE-2026-79768US | — | — | ||
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form i… | ||||
| CVE-2026-73637US | — | — | ||
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication st… | ||||
| CVE-2026-73636US | —OT elevated | — | ||
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to rep… | ||||
| CVE-2026-63718US | — | — | ||
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi resp… | ||||
| CVE-2026-63686US | — | — | ||
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of se… | ||||
| CVE-2026-63292US | — | — | ||
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service… | ||||
| CVE-2026-63045US | — | — | ||
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurati… | ||||
| CVE-2026-59797US | — | — | ||
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions.
This issue affects Apache HTTP Server: from 2.4.0 throug… | ||||
| CVE-2026-59685US | — | — | ||
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded.
This issue affects Apache HTTP Server: from… | ||||
| CVE-2026-58415US | — | — | ||
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read Web… | ||||
| CVE-2026-57941US | — | — | ||
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | ||||
| CVE-2026-56449US | — | — | ||
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.
This issue affects Apache HTTP Server version 2.4.68. | ||||
| CVE-2026-56154US | — | — | ||
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...})
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | ||||
| CVE-2026-56153US | — | — | ||
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | ||||
| CVE-2026-48005US | —OT elevated | — | ||
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a… | ||||
| CVE-2026-47360US | — | — | ||
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove changes across internal… | ||||
| CVE-2026-46729US | — | — | ||
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | ||||
| CVE-2026-42528US | — | — | ||
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.
Users are recomme… | ||||
| CVE-2026-42356US | — | — | ||
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target mu… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-89860 vom 2026-10-27external
- Red Hat Security Advisory RHSA-2026:74858 vom 2026-10-02external
- Red Hat Security Advisory RHSA-2026:88229 vom 2026-10-22external
- Red Hat Security Advisory RHSA-2026:89860 vom 2026-10-26external
- Amazon Linux Security Advisory ALAS2-2026-3990 vom 2026-10-13external
- Apache 2.4.69 Changelog vom 2026-10-01external
- Rocky Linux Security Advisory RLSA-2026:88229 vom 2026-10-23external
- Rocky Linux Security Advisory RLSA-2026:89860 vom 2026-10-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan