Apache Software Foundation vulnerabilities and threats

CVE-2026-34033 is a medium severity vulnerability in Apache Answer affecting versions before 2.0.1. It involves improper neutralization of script-related HTML tags (basic XSS) where user-supplied content is included in notification emails without proper escaping. This allows authenticated users to inject arbitrary HTML into emails sent to other users. The issue is fixed in Apache Answer version 2.0.1.

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Apache Answer versions up to and including 2.0.0 contain a vulnerability where timeline-related APIs do not enforce proper authorization checks. This flaw allows authenticated users to access deleted, private, or unapproved content and its revision history. The issue is fixed in version 2.0.1. The vulnerability has a medium severity with a CVSS score of 6.1.

CVE-2026-25688 is a medium severity vulnerability in Apache Answer up to version 2.0.0. It involves improper neutralization of alternate cross-site scripting (XSS) syntax in AI-generated response content, which is rendered in the browser without proper sanitization. This flaw allows malicious scripts to execute when the content is viewed. The issue is fixed in version 2.0.1.

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

A Use After Free vulnerability exists in the Apache HTTP Server module mod_http2 when file handles are exhausted. This affects Apache HTTP Server versions from 2.4.55 through 2.4.67. The vulnerability can lead to limited confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently confirmed.

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

A critical buffer underwrite vulnerability (CWE-124) exists in Apache HTTP Server versions from 2.4.0 through 2.4.67. The flaw is triggered by crafted regular expressions in the server configuration. This vulnerability allows an attacker to potentially execute arbitrary code or cause denial of service. The issue is fixed in Apache HTTP Server version 2.4.68.

CVE-2026-44119 is an improper privilege management vulnerability in Apache HTTP Server versions up to 2.4.67. It allows local .htaccess authors to read files with the privileges of the httpd user. The issue is fixed in version 2.4.68. The vulnerability has a medium severity with a CVSS score of 5.5.

An out-of-bounds read vulnerability (CWE-125) exists in Apache HTTP Server versions from 2.4.0 through 2.4.67 when using mod_headers and mod_mime with multiple response languages. This flaw could allow an attacker to read memory outside the intended buffer. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

A path handling vulnerability exists in the mod_dav_fs module of Apache HTTP Server versions 2.4.67 and earlier. This flaw allows a WebDAV content author to manipulate trusted DAV property databases, which can lead to child process crashes. The issue is resolved in version 2.4.68, and users should upgrade to this version to mitigate the risk.

A heap-based buffer overflow vulnerability exists in Apache HTTP Server versions from 2.4.0 through 2.4.67, related to interactions with malicious backend servers and the ProxyPassReverseCookie* directive. This vulnerability can cause a denial of service due to server crashes. The issue is fixed in Apache HTTP Server version 2.4.68.

CVE-2026-44186 is a high-severity vulnerability in the Apache HTTP Server's mod_proxy_ftp module that causes an infinite loop due to an unreachable exit condition. This affects versions from 2.4.0 through 2.4.67. The vulnerability can be triggered by an attacker-controlled backend FTP server. Users are advised to upgrade to version 2.4.68, which addresses this issue.

CVE-2026-29170 is a cross-site scripting (XSS) vulnerability in Apache HTTP Server's mod_proxy_ftp module affecting versions 2.4.67 and earlier. The issue occurs during HTML directory list generation when listing FTP directory contents via forward or reverse proxy. This vulnerability allows an attacker to inject malicious scripts that could be executed in the context of the user's browser. The Apache Software Foundation recommends upgrading to version 2.4.68 to address this vulnerability.

A critical Use After Free vulnerability (CWE-416) exists in the mod_ldap module of Apache HTTP Server affecting per-directory configuration. This vulnerability impacts Apache HTTP Server versions from 2.4.0 through 2.4.67. It allows for potential complete compromise of confidentiality, integrity, and availability. Users are advised to upgrade to version 2.4.68, which addresses this vulnerability.

## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins. ## Impact An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response. This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0. Users are recommended to upgrade to version 6.0.1, which fixes the issue.

A critical deserialization vulnerability (CWE-502) exists in Apache Fory fory-core Java SDK versions before 1.1.0. It allows remote attackers to bypass security checks and invoke dangerous Java serialization hooks via crafted serialized data. Upgrading to version 1.1.0 or later addresses this issue.