httpd

Apache HTTP Server

Current: 2.4.68
Candidate: 2.4.70Stale

License: Apache-2.0

Build

Target	Result	Last successful version	Succeeded at
rva23	Succeeded	2.4.68	2026-09-23 11:02:25 UTC
rva20	Succeeded	2.4.68	2026-09-23 00:57:15 UTC
x86_64	Succeeded	2.4.68	2026-09-21 22:49:52 UTC

Advisory · 20

Query product: http_serverNVD
Query vendor: apacheNVD
Query version: 2.4.68NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

CVE-2026-42356
NVD
Summary
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.438%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-42528
NVD
Summary
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issueNVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.416%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LNVD
References
Advisory · httpd.apache.org
CVE-2026-46729
NVD
Summary
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.451%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-47360
NVD
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.386%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.60, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-48005
NVD
Summary
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.565%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-56153
NVD
Summary
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.465%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-56154
NVD
Summary
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.536%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-56449
NVD
Summary
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.571%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-57941
NVD
Summary
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.594%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-58415
NVD
Summary
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.482%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-59685
NVD
Summary
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.465%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-59797
NVD
Summary
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.504%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-63045
NVD
Summary
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.441%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-63292
NVD
Summary
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.948%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-63686
NVD
Summary
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.46%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-63718
NVD
Summary
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.434%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.30, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-73636
NVD
Summary
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.397%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · httpd.apache.org
CVE-2026-73637
NVD
Summary
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.466%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LNVD
References
Advisory · httpd.apache.org
CVE-2026-79768
NVD
Summary
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.55%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; >= 2.4.0, < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NNVD
References
Advisory · httpd.apache.org
CVE-2026-93546
NVD
Summary
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.NVD
EPSS model date
2026-11-09FIRST
EPSS probability
0.429%FIRST
Vulnerable CPE criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*; < 2.4.69NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · httpd.apache.org

Description

The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems including UNIX and Windows. The goal of this project is to provide a secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards.

Changelog

SPECS: httpd: Enable HTTP/2 support
Li Guan7c2000925a112026-09-17 07:04:30 UTC
SPECS: httpd: Update to 2.4.68
Kai Zhanga2ff4581be6e2026-09-02 03:51:24 UTC
SPECS: Add httpd
Yafen Fangfd6deb2730452025-12-12 03:00:21 UTC

PR · 3

#1317 SPECS: Drop obsolete mod_http2 package
Leetfs2026-09-17 14:17:48 UTC
#1218 SPECS: httpd: Update to 2.4.68
laokz2026-09-02 06:38:29 UTC
#104 SPECS: *: Fix style %{?autochangelog} -> %autochangelog (automated)
dramforever2026-04-09 06:15:39 UTC

Issue · 2

#1217 Drop package mod_http2
laokz2026-09-17 14:17:44 UTC
#1180 httpd: Update to 2.4.68
wzssyqa2026-09-02 06:38:26 UTC

Checks

Monitor	Observation	Last checked
Source	Stale Repository refresh: git fetch exited 128 (authentication)	2026-11-10 13:32:55 UTC
Version	Stale Source last confirmed at 2026-11-10T13:32:55+00:00; repository refresh overdue.	2026-11-10 11:36:14 UTC
Build	Checked	2026-11-10 16:16:16 UTC
GitHub	Checked	2026-11-10 16:13:35 UTC
EOL	Checked Current source cycle 2.4; upstream lifecycle only.	2026-11-10 12:02:51 UTC
LicenseDiff	Not configured No reliable monitor identity/configuration.	—
Dependencies	Not configured No reliable monitor identity/configuration.	—
Advisory	Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.	2026-11-10 07:10:49 UTC Last attempted2026-11-10 13:07:13 UTC
Yanked	Not configured No reliable monitor identity/configuration.	—

Monitor	Checks
Source	6367 Stale 17 CheckFailed
Version	5462 Stale 207 CheckFailed 707 Not configured 8 Input unavailable
Build	6382 Checked 2 Not yet checked
GitHub	6384 Checked
EOL	6260 Not configured 118 Checked 3 Metadata unavailable 3 Input unavailable
LicenseDiff	1665 Not configured 187 Input changed 3173 Not applicable 1137 Checked 11 Input unavailable 207 Metadata unavailable 4 CheckFailed
Dependencies	1852 Not configured 3213 Checked 59 Partial evidence 1248 Metadata unavailable 7 Input unavailable 5 CheckFailed
Advisory	4996 Checked 1375 Not configured 7 Input unavailable 6 Metadata unavailable
Yanked	2248 Not configured 4116 Checked 5 CheckFailed 7 Input unavailable 8 Metadata unavailable