The SUSE Product Security Team released a security update for Apache2 that fixes 13 vulnerabilities spanning multiple modules. These include a use-after-free in mod_ldap (CVE-2026-29167), XSS in mod_proxy_ftp (CVE-2026-29170), buffer overflows in mod_proxy_html and from malicious backend servers, child process crashes due to path manipulation, heap-based buffer overflows from untrusted content, out-of-bound reads causing crashes, improper privilege management leading to unauthorized reads, stack buffer over-reads in mod_ssl OCSP, denial of service via resource exhaustion from attacker-controlled FTP backends, buffer underwrites from crafted regular expressions, use-after-free from file handle exhaustion in mod_http2, and a fix for cookie header accounting against LimitRequestFields. These vulnerabilities collectively pose risks of crashes, unauthorized data access, and denial of service.

Successful exploitation of these vulnerabilities could result in server crashes, unauthorized information disclosure, denial of service conditions, and potential execution of arbitrary code due to buffer overflows and use-after-free issues. The vulnerabilities affect multiple Apache2 modules, increasing the attack surface. No known exploits in the wild have been reported at this time.

A security update has been released by the SUSE Product Security Team addressing all listed vulnerabilities. Users should apply this official update promptly to remediate these issues. No additional mitigation steps are indicated beyond applying the provided security update.