Multiple vulnerabilities in Apache HTTP Server

Description

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in mod_ldap can be exploited remotely to execute arbitrary code.
2. Cross-site scripting (XSS) vulnerability in mod_proxy_ftp can be exploited to perform cross-site scripting attack.
3. A remote code execution vulnerability in mod_proxy_html can be exploited remotely to execute arbitrary code.
4. A remote code execution vulnerability in proxy handling can be exploited remotely to execute arbitrary code.
5. Security vulnerability in mod_dav_fs can be exploited to bypass security restrictions.
6. Denial of service vulnerability in mod_xml2enc can be exploited remotely to cause denial of service.
7. Denial of service vulnerability in `merge_response_headers` can cause crash can be exploited remotely to cause denial of service.
8. Security vulnerability in Apache HTTP Server can be exploited to bypass security restrictions.
9. A remote code execution vulnerability in mod_ssl can be exploited remotely to execute arbitrary code.
10. Security vulnerability in mod_proxy_ftp can be exploited to bypass security restrictions.
11. A remote code execution vulnerability in `ap_regname` via Signed Char Overflow can be exploited remotely to execute arbitrary code.
12. A remote code execution vulnerability in mod_http2 can be exploited remotely to execute arbitrary code.
13. Denial of service vulnerability in mod_http2 can be exploited remotely to cause denial of service.

Original advisories

• Fixed in Apache HTTP Server 2.4.68

Exploitation

Public exploits exist for this vulnerability.

Related products

• Apache-HTTP-Server

CVE list

• CVE-2026-49975
  critical
• CVE-2026-29167
  critical
• CVE-2026-29170
  high
• CVE-2026-34355
  critical
• CVE-2026-34356
  critical
• CVE-2026-42535
  critical
• CVE-2026-42536
  critical
• CVE-2026-43951
  high
• CVE-2026-44119
  high
• CVE-2026-44185
  high
• CVE-2026-44186
  high
• CVE-2026-44631
  critical
• CVE-2026-48913
  high

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com