The release of Apache HTTP Server 2.4.67 presented 11 vulnerabilities and several fixes. The most dangerous vulnerability (CVE-2026-23918) is caused by double memory release in the mod_http2 module and could potentially lead to remote code execution on the server through HTTP/2 protocol manipulation. The vulnerability is only present in the 2.4.66 release. It has been assigned a severity level of 8.8 out of 10.
Another vulnerability (CVE-2026-24072) with a severity level of 8.8 exists in the mod_rewrite module and allows local users hosting, with permission to create '.htaccess' files, to read the contents of any files on the system with the privileges of the user under which the httpd process is running.
Less critical vulnerabilities:
- CVE-2026-28780 — a buffer overflow in mod_proxy_ajp, which can be exploited when connecting the proxy to a malicious AJP server. By sending specially crafted AJP messages (Apache JServ Protocol), it is possible to write 4 bytes beyond the allocated buffer.
- CVE-2026-33523 — the potential to perform an HTTP response splitting attack on front-end-back-end systems, allowing for the injection of additional response headers or splitting responses to interject content into responses being processed in the same thread between the front-end and back-end.
- CVE-2026-33006 — an out-of-band attack (timing analysis) on mod_auth_digest, allowing for the bypassing of Digest authentication.
- CVE-2026-29168 — inadequate resource allocation limits when processing specially crafted OCSP responses in mod_md.
- CVE-2026-29169 — a null pointer dereference in the mod_dav_lock module, which can be used to trigger a crash of the server process.
- CVE-2026-33007 — a null pointer dereference in the mod_authn_socache module, which can be used to trigger a crash of the child process in configurations with a caching proxy.
- CVE-2026-33857 — reading a single byte from memory outside the allocated buffer in the mod_proxy_ajp module.
- CVE-2026-34032 — reading data from memory outside the allocated buffer due to the absence of a check for a null terminator in mod_proxy_ajp.
- CVE-2026-34059 — memory content leakage in mod_proxy_ajp.
Additionally, this release fixes non-security-related bugs in mod_http2 and mod_md, as well as adds new MIME types to the conf/mime.types file: vnd.sqlite3, HEIC, HEIF.
Source: opennet.ru
