The Apache Software Foundation released HTTP Server version 2.4.68 on June 8, 2026, addressing 12 security vulnerabilities spanning low to moderate-severity ratings.
The update covers a wide range of affected modules from proxy handling and WebDAV to HTTP/2 and SSL and affects all deployments running Apache httpd versions 2.4.0 through 2.4.67.
Security teams managing web infrastructure should treat this update as a priority, particularly given the number of moderate-severity flaws that could lead to privilege escalation, denial-of-service attacks, or process crashes.
Fix For Use-After-Free, DoS, XSS, and Buffer Overflow Flaws
Two use-after-free vulnerabilities were patched in this release, both carrying the potential for memory corruption and unpredictable process behavior.
CVE-2026-29167 affects mod_ldap in per-directory configurations, where a dangling pointer can be triggered across versions 2.4.0–2.4.67.
The flaw was reported to the Apache security team on March 2, 2026, by Pavel Kohout of Aisle Research, and fixed in the 2.4.x branch on June 3, 2026.
The second UAF, CVE-2026-48913, impacts the mod_http2 module specifically when file handles are already exhausted affecting the narrower range of 2.4.55–2.4.67.
Reported by Sam Lovejoy of IBM X-Force Offensive Research (XOR) on May 22, 2026, this flaw introduces a dangerous race condition under high server load scenarios where file descriptor limits are reached.
Cross-Site Scripting (XSS)
CVE-2026-29170 describes an XSS vulnerability in mod_proxy_ftp‘s HTML directory listing generation. When Apache proxies FTP directory contents either via forward or reverse proxy configuration, unsanitized output in the dynamically generated HTML allows an attacker to inject arbitrary scripts into a victim’s browser session.
Rated low severity, this issue affects all versions through 2.4.67 and was discovered by Pavel Kohout of Aisle Research, with the report received on March 4, 2026.
Buffer Overflow and Memory Corruption
Four distinct buffer overflow vulnerabilities were remediated, spanning proxy handling, XML encoding, and core configuration parsing:
- CVE-2026-34355 (Moderate) — A buffer overflow in
mod_proxy_htmlexploitable by an untrusted backend server. Discovered by Elhanan Haenel and Junhui Lee. - CVE-2026-34356 (Low) — A heap-based overflow in
ProxyPassReverseCookieMaptriggered by malicious backend servers using theProxyPassReverseCookie*directive. Discovered by Arkadi Vainbrand and depthfirst. - CVE-2026-42536 (Low) — A heap overflow in
mod_xml2encviaxml2StartParsewhen processing untrusted content. Reported by Zhenpeng (Leo) Lin of depthfirst on April 27, 2026. - CVE-2026-44631 (Low) — A heap underwrite in
ap_regnamecaused by a signed char overflow when parsing crafted regular expressions in server configuration files. Found by Zhenpeng (Leo) Lin and Bartlomiej Dmitruk.
Denial of Service
Two DoS vulnerabilities were addressed. CVE-2026-49975 (Moderate) discovered by Quang Luong of Calif.IO in collaboration with OpenAI Codex allows memory allocation exhaustion in mod_http2 via maliciously crafted HTTP/2 requests, affecting a broad range of versions from 2.4.17–2.4.67.
CVE-2026-44186 (Moderate) triggers an infinite loop in mod_proxy_ftp‘s proxy_ftp_handler via an attacker-controlled backend FTP server, affecting versions 2.4.0–2.4.67.
Both flaws can render affected servers unresponsive without any authentication requirement, making them particularly dangerous in internet-facing deployments.
Other Fixes
- CVE-2026-43951 (Moderate) — An out-of-bounds read in
merge_response_headerstriggered whenmod_headersandmod_mimejointly handle responses with multiple content languages, leading to child process crashes. - CVE-2026-42535 (Moderate) — A path handling flaw in
mod_dav_fsthat allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially crashing child processes. - CVE-2026-44185 (Low) — A stack buffer over-read in
mod_ssl‘s OCSPsend_requestfunction, exploitable via attacker-controlled OCSP servers during outbound certificate validation. - CVE-2026-44119 (Moderate) — A privilege escalation flaw in Apache’s expression evaluation across multiple modules, allowing local
.htaccessauthors to read arbitrary files with the privileges of the httpd user; affects 2.4.0–2.4.67.
| CVE | Module | Severity | Vulnerability Type |
|---|---|---|---|
| CVE-2026-29167 | mod_ldap | Low | Use-After-Free |
| CVE-2026-29170 | mod_proxy_ftp | Low | XSS |
| CVE-2026-34355 | mod_proxy_html | Moderate | Buffer Overflow |
| CVE-2026-34356 | ProxyPassReverseCookieMap | Low | Heap Overflow |
| CVE-2026-42535 | mod_dav_fs | Moderate | Path Handling |
| CVE-2026-42536 | mod_xml2enc | Low | Heap Overflow |
| CVE-2026-43951 | mod_headers / mod_mime | Moderate | OOB Read |
| CVE-2026-44119 | .htaccess expressions | Moderate | Privilege Escalation |
| CVE-2026-44185 | mod_ssl OCSP | Low | Stack Buffer Over-Read |
| CVE-2026-44186 | mod_proxy_ftp | Moderate | DoS — Infinite Loop |
| CVE-2026-44631 | ap_regname | Low | Heap Underwrite |
| CVE-2026-48913 | mod_http2 | Low | Use-After-Free |
| CVE-2026-49975 | mod_http2 | Moderate | DoS — Memory Exhaustion |
Apache strongly recommends that all users upgrade to version 2.4.68 immediately. No workarounds or mitigations are offered as alternatives to patching. The updated release is available for download at the official Apache HTTP Server download page.
Organizations with internet-facing Apache deployments should prioritize CVE-2026-44119 and CVE-2026-49975, given their potential for privilege escalation and denial-of-service, respectively.
Security teams should also audit proxy configurations and WebDAV-enabled environments for exposure to the buffer overflow and path traversal flaws patched in this release.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
