Loading story…
Apache released HTTP Server 2.4.69 to address 20 vulnerabilities in earlier 2.4.x releases, including potential remote code execution, memory corruption, response smuggling, information disclosure, and denial of service. Highlighted flaws affect CGI redirect handling (CVE-2026-42356), mod_http2 (CVE-2026-57941), mod_vhost_alias (CVE-2026-63292), and mod_proxy_uwsgi (CVE-2026-63718). Exploitability depends heavily on enabled modules and configuration; higher-risk deployments include mod_vhost_alias installations accepting Host headers longer than 8,192 bytes, WebDAV services granting authenticated write access, Windows-hosted servers, and certain proxy configurations. Severity assessments differ: Italy’s CSIRT classifies three vulnerabilities as critical and 13 as high, while another advisory highlights five Moderate-severity issues. Tenable rates the Alpine update Critical with a CVSS score of 9.8; its supplied plugin metadata reports no known exploits.
Organizations should prioritize upgrading to Apache HTTP Server 2.4.69 or distribution packages containing equivalent fixes. Tenable recommends 2.4.69-r0 or later for affected Alpine apache2 packages and separately flags CVE-2026-59797 as unpatched for Debian 12, 13, and 14; administrators should verify current vendor advisories and account for backported fixes rather than relying solely on upstream version numbers. Inventory installations, audit loaded modules and relevant directives, test updates, and confirm the running server uses the patched package. Where patching must be delayed, apply module-specific temporary controls to limit exposure, especially for publicly reachable services with the higher-risk configurations.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Tenable published Cloud Security plugin 472283 covering 20 CVEs in Alpine Linux apache2 packages and recommending version 2.4.69-r0 or later. The plugin is rated Critical with a CVSS v3 score of 9.8 and reports no known exploits.
The Apache Software Foundation released HTTP Server 2.4.69, addressing 20 vulnerabilities in earlier 2.4.x releases. Fixes cover configuration-dependent code execution, memory corruption, authentication and access-control weaknesses, information disclosure, and denial of service.
Tenable’s Apache HTTP Server vulnerability metadata records April 3, 2026, as a vulnerability publication date. The supplied excerpt does not identify which of the 20 referenced CVEs were published on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
boho.or.kr
Open sourcetenable.com
Open sourcelinuxsecurity.com
Open sourceacn.gov.it
Open sourcethecybersecguru.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Apache Software Foundation released **Apache HTTP Server 2.4.68** to patch 13 vulnerabilities affecting versions prior to `2.4.68`, with many issues spanning `2.4.0` through `2.4.67`. The flaws span multiple modules, including `mod_http2`, `mod_proxy_ftp`, `mod_proxy_html`, `mod_ssl`, `mod_ldap`, `mod_dav_fs`, `mod_xml2enc`, and `mod_headers`, and include use-after-free, heap and buffer overflows, out-of-bounds reads, denial-of-service conditions, cross-site scripting, privilege-escalation and path-handling weaknesses. Apache and national defenders, including Canada’s Cyber Centre, urged administrators to review the advisory and upgrade because workarounds are unavailable for most of the issues. Notable CVEs include `CVE-2026-49975`, a `mod_http2` denial-of-service bug triggered by excessive size values in malicious HTTP/2 requests; `CVE-2026-48913`, a `mod_http2` memory-corruption issue when file handles are exhausted; `CVE-2026-34355` and `CVE-2026-34356`, buffer-overflow flaws tied to untrusted backend systems in `mod_proxy_html` and `ProxyPassReverseCookie*`; `CVE-2026-44631`, a heap underflow in `ap_regname` caused by crafted regular expressions; `CVE-2026-29167`, a `mod_ldap` per-directory use-after-free; `CVE-2026-29170` and `CVE-2026-44186` in `mod_proxy_ftp`; `CVE-2026-44185` in `mod_ssl` OCSP handling; and `CVE-2026-42535` in `mod_dav_fs`. The release also ships non-security changes such as OpenSSL 4.0 support and `mod_http2` updates, but the immediate priority for exposed environments is upgrading all Apache HTTP Server deployments to `2.4.68`.
Jun 29, 2026
Apache HTTP Server 2.4.39 fixed six vulnerabilities: `CVE-2019-0196`, `CVE-2019-0197`, `CVE-2019-0211`, `CVE-2019-0215`, `CVE-2019-0217`, and `CVE-2019-0220`. The issues included HTTP/2 memory-safety and crash conditions, a local privilege-escalation flaw affecting Unix MPMs, a TLS 1.3 client-certificate authorization bypass, an authentication race that could permit user impersonation, and inconsistent handling of repeated URL-path slashes. F5 reported that its supported products were not affected by `CVE-2019-0196`, `CVE-2019-0197`, or `CVE-2019-0220`. Apache’s broader 2.4 security record also documented risks in optional HTTP/2, proxy, session, TLS, and authentication components, including access-control bypasses and potential information disclosure or remote code execution in `mod_proxy_uwsgi`. Debian subsequently issued an LTS update for Debian 9’s `apache2` package, version `2.4.25-3+deb9u10`, fixing seven vulnerabilities—including `CVE-2020-1927`, `CVE-2020-1934`, `CVE-2020-35452`, `CVE-2021-26690`, `CVE-2021-26691`, `CVE-2021-30641`, and `CVE-2021-31618`—that could cause denial of service or incorrect `MergeSlashes` behavior; affected systems should upgrade their Apache packages.
Aug 29, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.67** to fix five vulnerabilities, led by **`CVE-2026-23918`**, an important- to high-severity flaw in the HTTP/2 implementation. Apache said the bug is a **double free** triggered by an early reset that could lead to **remote code execution**, and that it affects **version 2.4.66**. The issue was reported in December 2025 and fixed shortly afterward, with public disclosure following on the `oss-sec` mailing list; Bartlomiej Dmitruk of striga.ai and Stanislaw Strzalkowski of isec.pl were credited with finding it. The 2.4.67 release also patches **`CVE-2026-24072`** in `mod_rewrite`, which can allow local `.htaccess` authors to read arbitrary files as the `httpd` user, along with lower-severity issues in `mod_proxy_ajp`, `mod_md`, and `mod_dav_lock`. Apache and downstream reporting urged organizations running **2.4.66 or earlier** to upgrade immediately, while temporary mitigations for environments that cannot patch at once include disabling **HTTP/2**, removing `mod_dav_lock`, and reviewing `.htaccess` permissions.
Jun 29, 2026