httpd security update (CVE-2026-42528)

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected by multiple security vulnerabilities across several modules. Notable issues include a memory calculation bug in mod_dav allowing server child process crashes (CVE-2026-42528), NULL pointer dereference in mod_heartmonitor (CVE-2026-46729), exposure of sensitive information in mod_session_cookie (CVE-2026-47360), out-of-bounds write in mod_charset_lite (CVE-2026-56153), use-after-free vulnerabilities in mod_rewrite and mod_http2 (CVE-2026-56154, CVE-2026-57941), unauthorized access to internal state files in mod_dav_fs (CVE-2026-58415), out-of-bounds write on Windows (CVE-2026-59685), improper privilege management in mod_ssl (CVE-2026-59797), improper validation of FTP PASV reply in mod_proxy_ftp (CVE-2026-63045), stack-based buffer overflow in mod_vhost_alias (CVE-2026-63292), NULL pointer dereference in mod_xml2enc (CVE-2026-63686), HTTP request/response smuggling via mod_proxy_uwsgi (CVE-2026-63718), path equivalence vulnerability in mod_userdir (CVE-2026-79768), and integer overflow in mod_dav_fs (CVE-2026-93546). These vulnerabilities can cause denial of service, information disclosure, arbitrary code execution, and privilege escalation. The vendor has released version 2.4.69 to fix these issues.

The vulnerabilities collectively allow attackers to cause denial of service through crashes and resource corruption, expose sensitive information to unauthorized actors, execute arbitrary code remotely, escalate privileges improperly, and perform HTTP request smuggling attacks. These impacts affect server availability, confidentiality, and integrity. The CVSS score of 9.8 indicates a critical severity level with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

A patch is available in Apache HTTP Server version 2.4.69 that addresses all listed vulnerabilities. Users are strongly recommended to upgrade to version 2.4.69 to remediate these issues. No alternative mitigations are specified in the advisory; applying the official update is the primary remediation.