Security Vulnerabilities
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
9.8
EPSS Score
0.004
Published
2026-10-01
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-10-01
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.006
Published
2026-10-01
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-10-01
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
9.8
EPSS Score
0.004
Published
2026-10-01
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-10-01
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...})
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
9.8
EPSS Score
0.004
Published
2026-10-01
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-10-01
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.006
Published
2026-10-01
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-10-01