httpd security update (CVE-2026-56153)

Apache HTTP Server versions 2.4.0 through 2.4.68 contain multiple security vulnerabilities across several modules. These include out-of-bounds write issues in mod_charset_lite and Windows path processing, use-after-free vulnerabilities in mod_rewrite and mod_http2, improper privilege management in mod_ssl, and an HTTP request smuggling vulnerability in mod_proxy_uwsgi. Additional flaws include information disclosure via mod_dav_fs, improper FTP PASV reply validation in mod_proxy_ftp, stack-based buffer overflow in mod_vhost_alias, NULL pointer dereference in mod_xml2enc, path equivalence issues in mod_userdir, and an integer overflow in mod_dav_fs. These vulnerabilities collectively allow remote attackers to cause denial of service, execute arbitrary code, escalate privileges, or access unauthorized information. The Apache Software Foundation has released version 2.4.69 to fix these issues.

The vulnerabilities impact confidentiality, integrity, and availability of Apache HTTP Server deployments. They enable remote attackers to execute arbitrary code, cause denial of service conditions, escalate privileges improperly, and disclose sensitive internal state information. The CVSS score of 9.8 reflects critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A patch is available in Apache HTTP Server version 2.4.69 that addresses all listed vulnerabilities. Users should upgrade to version 2.4.69 promptly to mitigate these critical security issues. No alternative mitigations are specified in the advisory; upgrading is the recommended and effective remediation.