An improper validation vulnerability in the FTP PASV reply address handling of mod_proxy_ftp in Apache HTTP Server versions through 2.4.68 allows an untrusted FTP server, when used in a forward proxy configuration, to cause the proxy to open a data connection to an arbitrary third-party host. This issue is fixed in Apache HTTP Server version 2.4.69.
A Use After Free vulnerability (CVE-2026-56154) exists in the mod_rewrite module of Apache HTTP Server when using the lookahead feature (%{LA-U:HTTP:...}). This affects Apache HTTP Server versions from 2.4.0 through 2.4.68 and could lead to memory corruption, potentially allowing remote denial of service or arbitrary code execution. Ubuntu has released patches for affected LTS versions, and users are advised to update and restart Apache to apply fixes.
CVE-2026-63292 is a stack-based buffer overflow vulnerability in the mod_vhost_alias module of Apache HTTP Server affecting versions up to and including 2.4.68 on all platforms. The vulnerability can be triggered remotely by sending an HTTP request with a Host header longer than 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is set above its default. This flaw may cause denial of service or potentially allow arbitrary code execution. Upgrading to version 2.4.69 resolves the issue.
CVE-2026-63718 is a medium-severity vulnerability in Apache HTTP Server versions 2.4.30 through 2.4.68 affecting the mod_proxy_uwsgi module. It involves inconsistent interpretation of HTTP requests that can lead to HTTP request/response smuggling when processing crafted uwsgi responses containing Transfer-Encoding headers. This vulnerability impacts data integrity but does not affect confidentiality or availability. A patch is available to address this issue.
A use-after-free vulnerability exists in the mod_auth_digest module of Apache HTTP Server versions before 2.4.69. This vulnerability allows an unauthenticated remote attacker to cause authentication state corruption via concurrent Digest authentication requests when specific configuration options are enabled. The issue is resolved in Apache HTTP Server version 2.4.69. The vulnerability has a CVSS score of 7.3, indicating a medium severity level.
CVE-2026-63686 is a NULL pointer dereference vulnerability in the mod_xml2enc module of Apache HTTP Server versions before 2.4.69. This flaw allows an untrusted backend server to cause a denial of service (DoS) by sending a proxied response with a charset whose conversion partially succeeds and then fails. The issue affects all platforms running these versions. Upgrading to version 2.4.69 or later resolves the vulnerability.
CVE-2026-59797 is a critical improper privilege management vulnerability in Apache HTTP Server's mod_ssl module affecting versions from 2.4.0 through 2.4.68. It involves incorrect handling of SSLRequire and file-related expressions, potentially allowing an attacker to bypass intended access restrictions. The vulnerability has a CVSS score of 9.8, indicating high severity. Ubuntu has released patches for affected versions across multiple LTS releases, and users are advised to update and restart Apache to apply fixes.
A Use After Free vulnerability (CWE-416) exists in the mod_http2 module of Apache HTTP Server versions 2.4.0 through 2.4.68. This flaw is caused by shared session->bbtmp re-entrancy, potentially leading to memory corruption. The vulnerability could allow a remote attacker to cause denial of service or execute arbitrary code. No exploits are currently known in the wild. Fixes are available and have been released in updated Apache packages for multiple Ubuntu LTS versions.
An integer overflow vulnerability exists in the mod_dav_fs module of Apache HTTP Server versions up to 2.4.68. This flaw allows an authenticated WebDAV client with write access to crash worker processes and cause persistent corruption of a directory's property database by sending PROPPATCH requests containing many XML namespaces. The vulnerability has a high CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. Fixes are available through official patches distributed by Ubuntu for affected versions.
CVE-2026-73636 is a high-severity authentication bypass vulnerability in the mod_auth_digest module of Apache HTTP Server 2.4.x. It allows an attacker to replay captured digest credentials to bypass authentication when the AuthDigestNonceLifetime is set to 0. This affects Apache HTTP Server versions from 2.4.0 up to but not including 2.4.69. Upgrading to version 2.4.69 mitigates the issue.
CVE-2026-56153 is a high-severity out-of-bounds write vulnerability in the mod_charset_lite module of Apache HTTP Server versions 2.4.0 through 2.4.68. This vulnerability could lead to memory corruption and potentially impact confidentiality. There are no known exploits reported in the wild at this time.
CVE-2026-47360 is a high-severity vulnerability in Apache HTTP Server's mod_session_cookie module affecting versions 2.4.0 through 2.4.68. The flaw allows exposure of sensitive session cookie information to unauthorized actors due to improper handling of the SessionCookieRemove setting during internal redirects. This can result in session cookies being passed incorrectly to backend servers.
CVE-2026-42528 is a medium severity vulnerability in Apache HTTP Server up to version 2.4.68. It is caused by a memory allocation bug in the mod_dav module that allows an attacker with permission to create WebDAV locks to crash server child processes. The vulnerability is fixed in version 2.4.69.
CVE-2026-42356 is a vulnerability in Apache HTTP Server versions 2.4.60 through 2.4.68 where an internal redirect from CGI programs may cause the target to be incorrectly treated and executed as a CGI script. This occurs if the target is in a CGI-enabled directory and lacks another mod_mime-recognized extension. The vulnerability has a low severity rating with a CVSS score of 3.7.
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.
This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes the issue.
An out-of-bounds read vulnerability (CWE-125) exists in Apache HTTP Server versions from 2.4.0 through 2.4.67 when using mod_headers and mod_mime with multiple response languages. This flaw could allow an attacker to read memory outside the intended buffer. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
A path handling vulnerability exists in the mod_dav_fs module of Apache HTTP Server versions 2.4.67 and earlier. This flaw allows a WebDAV content author to manipulate trusted DAV property databases, which can lead to child process crashes. The issue is resolved in version 2.4.68, and users should upgrade to this version to mitigate the risk.
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
This issue affects Apache HTTP Server: 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.
Users are recommended to upgrade to version 2.4.67, which fixes this issue.