Apache HTTP Server 2.4.58 Patches Critical Use-After-Free, DoS, XSS
Key Takeaways The Apache Software Foundation has released Apache HTTP Server version 2.4.68. This update addresses 13 security vulnerabilities, including critical use-after-free, denial-of-service,...
Key Takeaways
- The Apache Software Foundation has released Apache HTTP Server version 2.4.68.
- This update addresses 13 security vulnerabilities, including critical use-after-free, denial-of-service, and cross-site scripting flaws.
- Affected versions range broadly from 2.4.0 through 2.4.67.
- Immediate upgrade to version 2.4.68 is strongly recommended for all administrators.
The Apache Software Foundation recently rolled out Apache HTTP Server version 2.4.68 on June 8, 2026. This significant update is crucial, as it resolves a total of 13 security vulnerabilities impacting various modules within the widely used web server software.
Table Of Content
The security flaws patched in this release encompass a range of serious issues, including use-after-free conditions, cross-site scripting (XSS), heap-based buffer overflows, denial-of-service (DoS) vulnerabilities, privilege escalation, and out-of-bounds read errors. These vulnerabilities affect nearly all versions of the Apache HTTP Server, specifically from 2.4.0 up to and including 2.4.67.
Given the breadth and severity of the issues addressed, administrators operating any previous release of the Apache HTTP Server are strongly advised to upgrade their installations without delay.
Apache HTTP Server 2.4.68
Use-After-Free (UAF) Flaws
The latest Apache update rectifies two distinct use-after-free vulnerabilities. The first, identified as CVE-2026-29167, affects the mod_ldap module when configured on a per-directory basis. This flaw, discovered by Pavel Kohout of Aisle Research, could lead to a dangling pointer being triggered across Apache versions 2.4.0 through 2.4.67.
The second UAF vulnerability, CVE-2026-48913, impacts the mod_http2 module. This specific issue arises when file handles are already exhausted and affects a slightly narrower range of versions, from 2.4.55 to 2.4.67. Sam Lovejoy of IBM X-Force Offensive Research (XOR) is credited with reporting this vulnerability.
Cross-Site Scripting (XSS)
A cross-site scripting vulnerability, CVE-2026-29170, was found in the mod_proxy_ftp module. This low-severity flaw occurs during the generation of HTML directory listings. When Apache is configured to proxy FTP directory content, either as a forward or reverse proxy, unsanitized output can enable the injection of malicious scripts. This issue affects all versions up to 2.4.67 and was also discovered by Pavel Kohout of Aisle Research.
Buffer Overflow and Memory Corruption
Four buffer overflow vulnerabilities have been addressed in this update:
- CVE-2026-34355: A moderate-severity buffer overflow in
mod_proxy_html, exploitable by an untrusted backend server. This was jointly discovered by Elhanan Haenel and Junhui Lee. - CVE-2026-34356: A low-severity heap-based overflow affecting
ProxyPassReverseCookieMap, triggered by malicious backend servers. Arkadi Vainbrand and depthfirst are credited with its discovery. - CVE-2026-42536: A low-severity heap overflow in
mod_xml2enc, occurring viaxml2StartParsewith untrusted content. Zhenpeng (Leo) Lin of depthfirst reported this issue. - CVE-2026-44631: A low-severity heap underwrite in
ap_regname, resulting from a signed char overflow in specially crafted regex configurations. This was found by Lin and Bartlomiej Dmitruk.
Denial of Service
The new Apache release also includes fixes for two denial-of-service vulnerabilities. CVE-2026-49975, rated as moderate severity, could allow for memory allocation exhaustion in the mod_http2 module through malicious HTTP/2 requests. This affects versions 2.4.17 through 2.4.67 and was discovered by Quang Luong of Calif.IO, in collaboration with OpenAI Codex. The second DoS flaw, CVE-2026-44186 (moderate severity), involves an infinite loop that can be triggered in mod_proxy_ftp‘s handler by an attacker-controlled backend FTP server.
Other Notable Fixes
- CVE-2026-43951 (Moderate): An out-of-bounds read vulnerability in
merge_response_headers, which could lead to child process crashes whenmod_headersandmod_mimeprocess multiple response languages. - CVE-2026-42535 (Moderate): A path handling flaw in
mod_dav_fsthat could enable WebDAV authors to manipulate trusted DAV property databases. - CVE-2026-44185 (Low): A stack buffer over-read in
mod_ssl‘s OCSPsend_requestfunction, exploitable via attacker-controlled OCSP servers. - CVE-2026-44119 (Moderate): A privilege escalation vulnerability allowing local
.htaccessauthors to read files with the privileges of thehttpduser. This issue was reported by 10 independent researchers.
| CVE | Module | Severity | Type |
|---|---|---|---|
| CVE-2026-29167 | mod_ldap | Low | Use-After-Free |
| CVE-2026-29170 | mod_proxy_ftp | Low | XSS |
| CVE-2026-34355 | mod_proxy_html | Moderate | Buffer Overflow |
| CVE-2026-34356 | ProxyPassReverseCookieMap | Low | Heap Overflow |
| CVE-2026-42535 | mod_dav_fs | Moderate | Path Handling |
| CVE-2026-42536 | mod_xml2enc | Low | Heap Overflow |
| CVE-2026-43951 | mod_headers/mod_mime | Moderate | OOB Read |
| <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44119" target
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.