Apache HTTP-server version 2.4.68 is released, fixing 13 vulnerabilities and making several changes.
Fixed vulnerabilities (the first 6 are of moderate severity, while the others are low):
- CVE-2026-34355 — buffer overflow in mod_proxy_html, occurring when accessing a backend controlled by an attacker.
- CVE-2026-49975 — denial of service via exhaustion of all available memory for the process.
- CVE-2026-44186 — infinite loop in mod_proxy_ftp, exploitable when accessing a malicious FTP server.
- CVE-2026-44119 — local users with rights to create .htaccess files can read the content of files with httpd user privileges.
- CVE-2026-43951 — crash of the process due to reading from a memory area outside the allocated buffer in mod_headers and mod_mime.
- CVE-2026-42535 — vulnerability in mod_dav_fs allows WebDAV content authors to access directories requiring elevated privileges.
- CVE-2026-29167 — use-after-free memory access in mod_ldap.
- CVE-2026-29170 — cross-site scripting in mod_proxy_ftp.
- CVE-2026-34356 — buffer overflow in the implementation of ProxyPassReverseCookieMap.
- CVE-2026-42536 — buffer overflow in mod_xml2enc.
- CVE-2026-44185 — reading from outside the buffer area in mod_ssl when querying the attacker's OCSP server.
- CVE-2026-44631 — buffer overflow when processing regular expressions in configuration.
- CVE-2026-48913 — use-after-free memory access in mod_http2, occurring when available file descriptors are exhausted.
Blandt ikke-sikkerhedsrelaterede forbedringer:
- Support for OpenSSL 4.0 has been implemented in mod_ssl and the ab utility.
- Recognition of SerialNumber attribute type has been added to mod_ssl.
- Support for the substitution "%{m}t" indicating the time with millisecond precision has been added to the ErrorLogFormat directive.
- The mod_http2 module has been updated to version 2.0.42.
Kilde: opennet.ru
