The release of HTTP server Apache 2.4.68 has been presented, addressing 13 vulnerabilities and introducing several changes.
Fixed vulnerabilities (the first 6 have a moderate level of severity, while the rest are low):
- CVE-2026-34355 — buffer overflow in mod_proxy_html, occurring when accessing a backend controlled by an attacker.
- CVE-2026-49975 — denial of service through exhaustion of all available memory for the process.
- CVE-2026-44186 — infinite looping in the mod_proxy_ftp module, exploited when accessing an FTP server controlled by the attacker.
- CVE-2026-44119 — local users with rights to create .htaccess files can read the contents of files with httpd user privileges.
- CVE-2026-43951 — process crash due to reading from memory outside the allocated buffer in mod_headers and mod_mime.
- CVE-2026-42535 — vulnerability in mod_dav_fs that allows WebDAV content authors to access directories requiring elevated privileges.
- CVE-2026-29167 — use after free in mod_ldap.
- CVE-2026-29170 — cross-site scripting in mod_proxy_ftp.
- CVE-2026-34356 — buffer overflow in the implementation of ProxyPassReverseCookieMap.
- CVE-2026-42536 — buffer overflow in mod_xml2enc.
- CVE-2026-44185 — reading from outside the buffer in mod_ssl when making requests to the attacker's OCSP server.
- CVE-2026-44631 — buffer overflow when processing regular expressions in configuration.
- CVE-2026-48913 — use after free in mod_http2, occurring when the available file descriptors are exhausted.
The mod_md module with ACME protocol implementation has been updated to version 2.6.6:
- Support for OpenSSL 4.0 has been implemented in mod_ssl and the ab utility.
- The recognition of the SerialNumber attribute type has been added in mod_ssl.
- Support for substitution "%{m}t" for logging time with millisecond precision has been added to the ErrorLogFormat directive.
- The mod_http2 module has been updated to version 2.0.42.
Source: opennet.ru
