This vulnerability is a heap-based buffer overflow in the Apache HTTP Server's mod_xml2enc module, specifically in the xml2StartParse function when handling untrusted input. It affects Apache HTTP Server versions from 2.4.0 up to and including 2.4.67. The flaw can be exploited remotely without authentication to cause denial of service by crashing worker processes or potentially to execute arbitrary code within the context of the server process. The vulnerability is tracked as CVE-2026-42536 and is associated with CWE-122 and CWE-120. Red Hat's advisory confirms the impact and provides mitigation steps including disabling the vulnerable module and upgrading to a patched version 2.4.68. The vulnerability does not require user interaction or privileges to exploit and has an unchanged scope. Red Hat has issued security updates for their RHEL products to address this issue.

The vulnerability allows remote attackers to cause denial of service by crashing Apache HTTP Server worker processes or potentially execute arbitrary code with the privileges of the Apache/httpd daemon. This impacts availability primarily, with a high risk of service disruption. Confidentiality and integrity impacts are considered potential but not confirmed. The vulnerability requires no privileges or user interaction and can be triggered over the network.

A fix is available in Apache HTTP Server version 2.4.68. Users should upgrade to this version to remediate the vulnerability. As a temporary mitigation, if the mod_xml2enc module is not essential, it can be disabled by commenting out the LoadModule xml2enc_module directive in the Apache configuration and restarting the service. Note that disabling this module may cause failures in configurations relying on XML encoding features such as mod_proxy_html. Red Hat strongly recommends applying the official patches provided in their security advisories for affected RHEL versions.