httpd security update (CVE-2026-48005)

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected by multiple security vulnerabilities. CVE-2026-48005 describes missing authentication checks in mod_auth_digest allowing unauthenticated denial of service via forged Authorization headers when Digest authentication with AuthDigestNcCheck is enabled. CVE-2026-58415 allows remote clients to read WebDAV dead properties via mod_dav_fs. CVE-2026-59685 is an out-of-bounds write on Windows when processing 8.3 path names. CVE-2026-59797 involves improper privilege management in mod_ssl. CVE-2026-63045 allows an untrusted FTP server to cause a proxy to open connections to arbitrary hosts via mod_proxy_ftp. CVE-2026-63292 is a stack-based buffer overflow in mod_vhost_alias triggered by oversized Host headers. CVE-2026-63686 is a NULL pointer dereference in mod_xml2enc via proxied responses. CVE-2026-63718 is an HTTP request/response smuggling vulnerability in mod_proxy_uwsgi. CVE-2026-73636 and CVE-2026-73637 involve authentication bypass and use-after-free in mod_auth_digest. CVE-2026-79768 concerns path equivalence issues in mod_userdir. CVE-2026-93546 is an integer overflow in mod_dav_fs allowing authenticated WebDAV clients to crash processes and corrupt property databases. All these issues are fixed in Apache HTTP Server 2.4.69.

These vulnerabilities collectively allow unauthenticated remote attackers to cause denial of service, bypass authentication, read unauthorized internal state files, execute arbitrary code, and cause persistent data corruption. The impact ranges from service disruption to potential full compromise of the affected server. The CVSS score of 9.8 indicates critical severity with high confidentiality, integrity, and availability impacts.

Users should upgrade Apache HTTP Server to version 2.4.69, which contains official fixes for all listed vulnerabilities. Applying this update will mitigate the risks associated with these security issues. No additional mitigations are specified beyond upgrading.