Vulnerability-Lookup

CVE-2026-28780 (GCVE-0-2026-28780)

Vulnerability from cvelistv5 – Published: 2026-05-05 21:29 – Updated: 2026-07-08 12:05

Title

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Summary

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-787 - Out-of-bounds Write

Assigner

apache

References

11 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/05/05/9
https://access.redhat.com/security/cve/CVE-2026-28780	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2466913	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:27200	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21433	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22140	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36373	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21391	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27201	vendor-advisoryx_refsource_REDHAT

Impacted products

11 products

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 0 , ≤ 2.4.66 (semver)
Red Hat	Red Hat JBoss Core Services on RHEL 7 Server	cpe:/a:redhat:jboss_core_services:1::el7
Red Hat	Red Hat JBoss Core Services on RHEL 8	cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	Red Hat Enterprise Linux AppStream (v. 10)	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux AppStream (v. 8)	cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux AppStream E4S (v.8.8)	cpe:/a:redhat:rhel_e4s:8.8::appstream
Red Hat	Red Hat Enterprise Linux AppStream TUS (v.8.8)	cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux AppStream (v. 9)	cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat JBoss Core Services 2.4.62.SP4	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Credits

Andrew Lacambra Elhanan Haenel Tianshuo Han (<hantianshuo233@gmail.com>) Tristan Madani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-05T22:24:30.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/05/9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28780",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-06T15:49:38.049896Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T15:50:18.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el7"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat JBoss Core Services on RHEL 7 Server",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat JBoss Core Services on RHEL 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 10)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 8)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 9)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat JBoss Core Services 2.4.62.SP4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-05T21:29:41.527Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in mod_proxy_ajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP (Apache JServ Protocol) server, to send a specially crafted message. This message can cause mod_proxy_ajp to write attacker-controlled data beyond a heap-based buffer, potentially leading to arbitrary code execution or a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T12:05:56.856Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
          },
          {
            "name": "RHBZ#2466913",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27200"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21433"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22140"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36373"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21391"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27201"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:27200: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21433: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22140: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36373: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21391: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27201: Red Hat JBoss Core Services 2.4.62.SP4"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-05T22:01:12.666Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-05T21:29:41.527Z",
            "value": "Made public."
          }
        ],
        "title": "Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.66",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrew Lacambra"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Elhanan Haenel"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tianshuo Han (\u003chantianshuo233@gmail.com\u003e)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHeap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\u003cbr\u003eIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: through 2.4.66.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.67, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T21:29:41.527Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-04T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-03-18T12:00:00.000Z",
          "value": "reported by 3rd finder"
        },
        {
          "lang": "en",
          "time": "2026-02-28T12:00:00.000Z",
          "value": "reported by 2nd finder"
        }
      ],
      "title": "Apache HTTP Server: buffer overflow in mod_proxy_ajp via  ajp_msg_check_header()",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-28780",
    "datePublished": "2026-05-05T21:29:41.527Z",
    "dateReserved": "2026-03-03T12:31:23.999Z",
    "dateUpdated": "2026-07-08T12:05:56.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-28780",
      "date": "2026-07-08",
      "epss": "0.01325",
      "percentile": "0.67528"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-28780\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-05-05T22:16:00.390\",\"lastModified\":\"2026-07-08T13:16:34.013\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\\n\\nThis issue affects Apache HTTP Server: through 2.4.66.\\n\\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache HTTP Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2.4.66\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Core Services on RHEL 7 Server\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:jboss_core_services:1::el7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Core Services on RHEL 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:jboss_core_services:1::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream TUS (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Core Services 2.4.62.SP4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:jboss_core_services:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-06T15:49:38.049896Z\",\"id\":\"CVE-2026-28780\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.4.67\",\"matchCriteriaId\":\"8FF781BA-CF81-400B-A155-4DAE0BD856EE\"}]}]}],\"references\":[{\"url\":\"https://httpd.apache.org/security/vulnerabilities_24.html\",\"source\":\"security@apache.org\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/05/9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21391\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21433\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22140\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27200\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27201\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36373\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-28780\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2466913\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/05/9\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-05-05T22:24:30.623Z\"}}, {\"title\": \"Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:jboss_core_services:1::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Core Services on RHEL 7 Server\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_core_services:1::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Core Services on RHEL 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_core_services:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Core Services 2.4.62.SP4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-05T22:01:12.666Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-05T21:29:41.527Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:27200: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21433: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22140: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36373: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21391: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27201: Red Hat JBoss Core Services 2.4.62.SP4\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-05T21:29:41.527Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-28780\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2466913\", \"name\": \"RHBZ#2466913\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27200\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21433\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22140\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36373\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21391\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27201\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in mod_proxy_ajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP (Apache JServ Protocol) server, to send a specially crafted message. This message can cause mod_proxy_ajp to write attacker-controlled data beyond a heap-based buffer, potentially leading to arbitrary code execution or a denial of service.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-08T12:05:56.856Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-28780\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-06T15:49:38.049896Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-06T15:49:53.062Z\"}}], \"cna\": {\"title\": \"Apache HTTP Server: buffer overflow in mod_proxy_ajp via  ajp_msg_check_header()\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Andrew Lacambra\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Elhanan Haenel\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Tianshuo Han (\u003chantianshuo233@gmail.com\u003e)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Tristan Madani\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"low\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache HTTP Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.4.66\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-04T12:00:00.000Z\", \"value\": \"reported\"}, {\"lang\": \"en\", \"time\": \"2026-03-18T12:00:00.000Z\", \"value\": \"reported by 3rd finder\"}, {\"lang\": \"en\", \"time\": \"2026-02-28T12:00:00.000Z\", \"value\": \"reported by 2nd finder\"}], \"references\": [{\"url\": \"https://httpd.apache.org/security/vulnerabilities_24.html\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\\n\\nThis issue affects Apache HTTP Server: through 2.4.66.\\n\\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eHeap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\u003cbr\u003eIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: through 2.4.66.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.67, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"CWE-122 Heap-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-05-05T21:29:41.527Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-28780\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-08T12:05:56.856Z\", \"dateReserved\": \"2026-03-03T12:31:23.999Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-05-05T21:29:41.527Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

alsa-2026:21391

Vulnerability from osv_almalinux

Published

2026-05-27 00:00

Modified

2026-05-29 09:40

Summary

Important: httpd security update

Details

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:21391	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-28780	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33007	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33857	REPORT
	https://access.redhat.com/security/cve/CVE-2026-34032	REPORT
	https://access.redhat.com/security/cve/CVE-2026-34059	REPORT
	https://bugzilla.redhat.com/2464940	REPORT
	https://bugzilla.redhat.com/2464952	REPORT
	https://bugzilla.redhat.com/2464953	REPORT
	https://bugzilla.redhat.com/2465299	REPORT
	https://bugzilla.redhat.com/2466913	REPORT
	https://errata.almalinux.org/9/ALSA-2026-21391.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "httpd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "httpd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "httpd-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "httpd-filesystem"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "httpd-manual"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "httpd-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "mod_ldap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "mod_lua"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "mod_proxy_html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "mod_session"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "mod_ssl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.62-13.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  \n\nSecurity Fix(es):  \n\n  * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)\n  * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)\n  * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)\n  * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)\n  * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:21391",
  "modified": "2026-05-29T09:40:22Z",
  "published": "2026-05-27T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:21391"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33007"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33857"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-34032"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-34059"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464940"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464952"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464953"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2465299"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2466913"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-21391.html"
    }
  ],
  "related": [
    "CVE-2026-34059",
    "CVE-2026-34032",
    "CVE-2026-33857",
    "CVE-2026-33007",
    "CVE-2026-28780"
  ],
  "summary": "Important: httpd security update"
}

alsa-2026:21433

Vulnerability from osv_almalinux

Published

2026-05-27 00:00

Modified

2026-05-28 12:35

Summary

Important: httpd security update

Details

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:21433	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-28780	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33007	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33857	REPORT
	https://access.redhat.com/security/cve/CVE-2026-34032	REPORT
	https://access.redhat.com/security/cve/CVE-2026-34059	REPORT
	https://bugzilla.redhat.com/2464940	REPORT
	https://bugzilla.redhat.com/2464952	REPORT
	https://bugzilla.redhat.com/2464953	REPORT
	https://bugzilla.redhat.com/2465299	REPORT
	https://bugzilla.redhat.com/2466913	REPORT
	https://errata.almalinux.org/10/ALSA-2026-21433.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "httpd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "httpd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "httpd-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "httpd-filesystem"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "httpd-manual"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "httpd-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "mod_ldap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "mod_lua"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "mod_proxy_html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "mod_session"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "mod_ssl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.63-13.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  \n\nSecurity Fix(es):  \n\n  * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)\n  * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)\n  * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)\n  * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)\n  * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:21433",
  "modified": "2026-05-28T12:35:43Z",
  "published": "2026-05-27T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:21433"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33007"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33857"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-34032"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-34059"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464940"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464952"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464953"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2465299"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2466913"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-21433.html"
    }
  ],
  "related": [
    "CVE-2026-34059",
    "CVE-2026-34032",
    "CVE-2026-33857",
    "CVE-2026-33007",
    "CVE-2026-28780"
  ],
  "summary": "Important: httpd security update"
}

alsa-2026:22140

Vulnerability from osv_almalinux

Published

2026-06-01 00:00

Modified

2026-06-03 08:00

Summary

Important: httpd:2.4 security update

Details

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)
httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:22140	ADVISORY
	https://access.redhat.com/security/cve/CVE-2025-53020	REPORT
	https://access.redhat.com/security/cve/CVE-2026-28780	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33007	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33857	REPORT
	https://access.redhat.com/security/cve/CVE-2026-34032	REPORT
	https://access.redhat.com/security/cve/CVE-2026-34059	REPORT
	https://bugzilla.redhat.com/2379343	REPORT
	https://bugzilla.redhat.com/2464940	REPORT
	https://bugzilla.redhat.com/2464952	REPORT
	https://bugzilla.redhat.com/2464953	REPORT
	https://bugzilla.redhat.com/2465299	REPORT
	https://bugzilla.redhat.com/2466913	REPORT
	https://errata.almalinux.org/8/ALSA-2026-22140.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "httpd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "httpd-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "httpd-filesystem"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "httpd-manual"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "httpd-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mod_http2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.7-10.module_el8.10.0+4185+0955a0d7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mod_ldap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mod_md"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.0.8-8.module_el8.10.0+4088+57f011c1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mod_proxy_html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mod_session"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mod_ssl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.  \n\nSecurity Fix(es):  \n\n  * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)\n  * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)\n  * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)\n  * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)\n  * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)\n  * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:22140",
  "modified": "2026-06-03T08:00:01Z",
  "published": "2026-06-01T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:22140"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-53020"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33007"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33857"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-34032"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-34059"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2379343"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464940"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464952"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2464953"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2465299"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2466913"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-22140.html"
    }
  ],
  "related": [
    "CVE-2025-53020",
    "CVE-2026-34059",
    "CVE-2026-34032",
    "CVE-2026-33857",
    "CVE-2026-33007",
    "CVE-2026-28780"
  ],
  "summary": "Important: httpd:2.4 security update"
}

bit-apache-2026-28780

Vulnerability from bitnami_vulndb

Published

2026-05-07 08:38

Modified

2026-07-06 06:18

Summary

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Details

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "apache",
        "purl": "pkg:bitnami/apache"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.67"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28780"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
  },
  "details": "Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
  "id": "BIT-apache-2026-28780",
  "modified": "2026-07-06T06:18:57.499Z",
  "published": "2026-05-07T08:38:43.651Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/05/9"
    },
    {
      "type": "WEB",
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28780"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:21391"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:21433"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:22140"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:27200"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:27201"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Apache HTTP Server: buffer overflow in mod_proxy_ajp via  ajp_msg_check_header()"
}

CERTFR-2026-AVI-0530

Vulnerability from certfr_avis - Published: 2026-05-05 - Updated: 2026-05-05

De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Apache	HTTP Server	Apache HTTP Server versions antérieures à 2.4.67

References

Title

Publication Time

CNVD-2026-21699

Vulnerability from cnvd - Published: 2026-05-26

Title

Apache HTTP Server堆缓冲区溢出漏洞

Description

Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server存在堆缓冲区溢出漏洞。该漏洞是由于mod_proxy_ajp中的边界检查不正确造成的，攻击者可利用该漏洞在系统上执行任意代码，或导致应用程序崩溃。

Severity

高

Patch Name

Apache HTTP Server堆缓冲区溢出漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://httpd.apache.org/security/vulnerabilities_24.html

Reference

https://httpd.apache.org/security/vulnerabilities_24.html

Impacted products

Name
Apache HTTP Server <=2.4.66

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-28780",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-28780"
    }
  },
  "description": "Apache HTTP Server\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7f51\u9875\u670d\u52a1\u5668\u3002\u8be5\u670d\u52a1\u5668\u5177\u6709\u5feb\u901f\u3001\u53ef\u9760\u4e14\u53ef\u901a\u8fc7\u7b80\u5355\u7684API\u8fdb\u884c\u6269\u5145\u7684\u7279\u70b9\u3002 \n\nApache HTTP Server\u5b58\u5728\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8emod_proxy_ajp\u4e2d\u7684\u8fb9\u754c\u68c0\u67e5\u4e0d\u6b63\u786e\u9020\u6210\u7684\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u6216\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://httpd.apache.org/security/vulnerabilities_24.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-21699",
  "openTime": "2026-05-26",
  "patchDescription": "Apache HTTP Server\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7f51\u9875\u670d\u52a1\u5668\u3002\u8be5\u670d\u52a1\u5668\u5177\u6709\u5feb\u901f\u3001\u53ef\u9760\u4e14\u53ef\u901a\u8fc7\u7b80\u5355\u7684API\u8fdb\u884c\u6269\u5145\u7684\u7279\u70b9\u3002 \r\n\r\nApache HTTP Server\u5b58\u5728\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8emod_proxy_ajp\u4e2d\u7684\u8fb9\u754c\u68c0\u67e5\u4e0d\u6b63\u786e\u9020\u6210\u7684\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u6216\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache HTTP Server\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache HTTP Server \u003c=2.4.66"
  },
  "referenceLink": "https://httpd.apache.org/security/vulnerabilities_24.html",
  "serverity": "\u9ad8",
  "submitTime": "2026-05-06",
  "title": "Apache HTTP Server\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

FKIE_CVE-2026-28780

Vulnerability from fkie_nvd - Published: 2026-05-05 22:16 - Updated: 2026-07-08 13:16

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@apache.org	https://httpd.apache.org/security/vulnerabilities_24.html	Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/05/05/9	Mailing List, Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:21391
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:21433
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:22140
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:27200
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:27201
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:36373
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-28780
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2466913
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json

Impacted products

	Vendor	Product	Version
	apache	http_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.66",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1::el7"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat JBoss Core Services on RHEL 7 Server",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1::el8"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat JBoss Core Services on RHEL 8",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Enterprise Linux AppStream (v. 10)",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Enterprise Linux AppStream (v. 8)",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Enterprise Linux AppStream (v. 9)",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat JBoss Core Services 2.4.62.SP4",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FF781BA-CF81-400B-A155-4DAE0BD856EE",
              "versionEndExcluding": "2.4.67",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue."
    }
  ],
  "id": "CVE-2026-28780",
  "lastModified": "2026-07-08T13:16:34.013",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28780",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-06T15:49:38.049896Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-05T22:16:00.390",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/05/05/9"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:21391"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:21433"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:22140"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:27200"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:27201"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:36373"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

GHSA-WPWW-4QVV-XPV8

Vulnerability from github – Published: 2026-05-06 00:31 – Updated: 2026-06-30 03:36

Details

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-28780"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-05T22:16:00Z",
    "severity": "CRITICAL"
  },
  "details": "Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
  "id": "GHSA-wpww-4qvv-xpv8",
  "modified": "2026-06-30T03:36:32Z",
  "published": "2026-05-06T00:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28780"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:21391"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:21433"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:22140"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:27200"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:27201"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
    },
    {
      "type": "WEB",
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/05/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0134

Vulnerability from csaf_ncscnl - Published: 2026-05-06 11:33 - Updated: 2026-05-06 11:33

Summary

Kwetsbaarheden verholpen in Apache HTTP Server

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: Apache Software Foundation heeft meerdere kwetsbaarheden verholpen in Apache HTTP Server.

Interpretaties: De kwetsbaarheden betreffen verschillende modules en functionaliteiten binnen Apache HTTP Server. De meest ernstige kwetsbaarheid betreft een double free in de HTTP/2-implementatie, die het voor een aanvaller mogelijk maakt om willekeurige code uit te voeren voorafgaand aan authenticatie. Lokale .htaccess auteurs kunnen via een privilege-escalatie toegang krijgen tot bestanden met httpd-gebruikersrechten. Het mod_proxy_ajp module bevat een heap-based buffer overflow en een out-of-bounds read, waardoor geheugenbeschadiging kan optreden. In de mod_md module is een resource allocatieprobleem aanwezig dat de serverprestaties kan beïnvloeden. De mod_dav_lock module bevat een NULL pointer dereference die kan leiden tot servercrashes en daarmee denial of service. De mod_auth_digest module kent een timing attack die Digest authenticatie kan omzeilen. De mod_authn_socache module heeft een NULL pointer dereference die crashes veroorzaakt bij caching forward proxy configuraties. Verder is er een HTTP response splitting kwetsbaarheid die manipulatie van HTTP headers mogelijk maakt. Daarnaast is er een improper null termination en out-of-bounds read in de core server functionaliteit, en een buffer over-read die kan leiden tot informatielekken of instabiliteit.

Oplossingen: Apache Software Foundation heeft versie 2.4.67 uitgebracht waarin alle genoemde kwetsbaarheden zijn verholpen. Zie bijgevoegde referenties voor meer informatie.

Kans: medium

Schade: high

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-122: Heap-based Buffer Overflow

CWE-125: Out-of-bounds Read

CWE-126: Buffer Over-read

CWE-170: Improper Null Termination

CWE-208: Observable Timing Discrepancy

CWE-269: Improper Privilege Management

CWE-415: Double Free

CWE-443: DEPRECATED: HTTP response splitting

CWE-476: NULL Pointer Dereference

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-1341: Multiple Releases of Same Resource or Handle

CVE-2026-23918

Apache HTTP Server 2.4.66 contains a critical double free vulnerability in its HTTP/2 implementation that enables remote code execution, fixed in version 2.4.67.

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-415 - Double Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-24072

An escalation of privilege vulnerability in Apache HTTP Server versions 2.4.66 and earlier allows local .htaccess authors to access files with httpd user privileges, resolved in version 2.4.67.

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-28780

A heap-based buffer overflow in Apache HTTP Server mod_proxy_ajp module allows a malicious AJP server to corrupt memory by writing beyond the buffer, affecting versions up to 2.4.66 and fixed in 2.4.67.

CWE-122 - Heap-based Buffer Overflow

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-29168

Apache HTTP Server versions 2.4.30 through 2.4.66 contain a resource allocation vulnerability in the mod_md module related to OCSP response data, resolved in version 2.4.67.

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-29169

A NULL pointer dereference vulnerability in mod_dav_lock of Apache HTTP Server 2.4.66 and earlier can cause server crashes, affecting versions up to 2.4.66.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-33006

A timing attack vulnerability in Apache HTTP Server 2.4.66's mod_auth_digest module allows remote attackers to bypass Digest authentication, fixed in version 2.4.67.

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-208 - Observable Timing Discrepancy

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-33007

A NULL pointer dereference vulnerability in mod_authn_socache of Apache HTTP Server 2.4.66 and earlier allows unauthenticated remote users to crash child processes in caching forward proxy setups, fixed in version 2.4.67.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-476 - NULL Pointer Dereference

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-33523

An HTTP response splitting vulnerability exists in multiple Apache HTTP Server modules up to version 2.4.66, which is resolved in version 2.4.67.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-33857

An out-of-bounds read vulnerability exists in the mod_proxy_ajp module of Apache HTTP Server versions up to 2.4.66, resolved in version 2.4.67.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-34032

Apache HTTP Server versions up to 2.4.66 contain an Improper Null Termination and Out-of-bounds Read vulnerability, which is addressed in version 2.4.67.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

CVE-2026-34059

A buffer over-read vulnerability in Apache HTTP Server versions up to 2.4.66 has been addressed in version 2.4.67, requiring users to upgrade to resolve the issue.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-126 - Buffer Over-read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* Apache Software Foundation / Apache HTTP Server		vers:unknown/*

References

12 references

URL	Category
https://httpd.apache.org/security/vulnerabilities…	external
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Apache Software Foundation heeft meerdere kwetsbaarheden verholpen in Apache HTTP Server.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden betreffen verschillende modules en functionaliteiten binnen Apache HTTP Server. De meest ernstige kwetsbaarheid betreft een double free in de HTTP/2-implementatie, die het voor een aanvaller mogelijk maakt om willekeurige code uit te voeren voorafgaand aan authenticatie. \n\nLokale .htaccess auteurs kunnen via een privilege-escalatie toegang krijgen tot bestanden met httpd-gebruikersrechten. Het mod_proxy_ajp module bevat een heap-based buffer overflow en een out-of-bounds read, waardoor geheugenbeschadiging kan optreden. In de mod_md module is een resource allocatieprobleem aanwezig dat de serverprestaties kan be\u00efnvloeden. De mod_dav_lock module bevat een NULL pointer dereference die kan leiden tot servercrashes en daarmee denial of service. De mod_auth_digest module kent een timing attack die Digest authenticatie kan omzeilen. De mod_authn_socache module heeft een NULL pointer dereference die crashes veroorzaakt bij caching forward proxy configuraties. Verder is er een HTTP response splitting kwetsbaarheid die manipulatie van HTTP headers mogelijk maakt. Daarnaast is er een improper null termination en out-of-bounds read in de core server functionaliteit, en een buffer over-read die kan leiden tot informatielekken of instabiliteit.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Apache Software Foundation heeft versie 2.4.67 uitgebracht waarin alle genoemde kwetsbaarheden zijn verholpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
        "title": "CWE-120"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Buffer Over-read",
        "title": "CWE-126"
      },
      {
        "category": "general",
        "text": "Improper Null Termination",
        "title": "CWE-170"
      },
      {
        "category": "general",
        "text": "Observable Timing Discrepancy",
        "title": "CWE-208"
      },
      {
        "category": "general",
        "text": "Improper Privilege Management",
        "title": "CWE-269"
      },
      {
        "category": "general",
        "text": "Double Free",
        "title": "CWE-415"
      },
      {
        "category": "general",
        "text": "DEPRECATED: HTTP response splitting",
        "title": "CWE-443"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Multiple Releases of Same Resource or Handle",
        "title": "CWE-1341"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Apache HTTP Server",
    "tracking": {
      "current_release_date": "2026-05-06T11:33:26.390004Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0134",
      "initial_release_date": "2026-05-06T11:33:26.390004Z",
      "revision_history": [
        {
          "date": "2026-05-06T11:33:26.390004Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Apache HTTP Server"
          }
        ],
        "category": "vendor",
        "name": "Apache Software Foundation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-23918",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Double Free",
          "title": "CWE-415"
        },
        {
          "category": "other",
          "text": "Multiple Releases of Same Resource or Handle",
          "title": "CWE-1341"
        },
        {
          "category": "description",
          "text": "Apache HTTP Server 2.4.66 contains a critical double free vulnerability in its HTTP/2 implementation that enables remote code execution, fixed in version 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-23918 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-23918.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-23918"
    },
    {
      "cve": "CVE-2026-24072",
      "notes": [
        {
          "category": "description",
          "text": "An escalation of privilege vulnerability in Apache HTTP Server versions 2.4.66 and earlier allows local .htaccess authors to access files with httpd user privileges, resolved in version 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-24072 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24072.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-24072"
    },
    {
      "cve": "CVE-2026-28780",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "A heap-based buffer overflow in Apache HTTP Server mod_proxy_ajp module allows a malicious AJP server to corrupt memory by writing beyond the buffer, affecting versions up to 2.4.66 and fixed in 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28780 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28780.json"
        }
      ],
      "title": "CVE-2026-28780"
    },
    {
      "cve": "CVE-2026-29168",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "Apache HTTP Server versions 2.4.30 through 2.4.66 contain a resource allocation vulnerability in the mod_md module related to OCSP response data, resolved in version 2.4.67.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-29168 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-29168.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-29168"
    },
    {
      "cve": "CVE-2026-29169",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "A NULL pointer dereference vulnerability in mod_dav_lock of Apache HTTP Server 2.4.66 and earlier can cause server crashes, affecting versions up to 2.4.66.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-29169 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-29169.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-29169"
    },
    {
      "cve": "CVE-2026-33006",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "notes": [
        {
          "category": "other",
          "text": "Observable Timing Discrepancy",
          "title": "CWE-208"
        },
        {
          "category": "description",
          "text": "A timing attack vulnerability in Apache HTTP Server 2.4.66\u0027s mod_auth_digest module allows remote attackers to bypass Digest authentication, fixed in version 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-33006 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33006.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-33006"
    },
    {
      "cve": "CVE-2026-33007",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "A NULL pointer dereference vulnerability in mod_authn_socache of Apache HTTP Server 2.4.66 and earlier allows unauthenticated remote users to crash child processes in caching forward proxy setups, fixed in version 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-33007 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33007.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-33007"
    },
    {
      "cve": "CVE-2026-33523",
      "notes": [
        {
          "category": "description",
          "text": "An HTTP response splitting vulnerability exists in multiple Apache HTTP Server modules up to version 2.4.66, which is resolved in version 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-33523 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33523.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-33523"
    },
    {
      "cve": "CVE-2026-33857",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability exists in the mod_proxy_ajp module of Apache HTTP Server versions up to 2.4.66, resolved in version 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-33857 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33857.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-33857"
    },
    {
      "cve": "CVE-2026-34032",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "other",
          "text": "Improper Null Termination",
          "title": "CWE-170"
        },
        {
          "category": "description",
          "text": "Apache HTTP Server versions up to 2.4.66 contain an Improper Null Termination and Out-of-bounds Read vulnerability, which is addressed in version 2.4.67.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-34032 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34032.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-34032"
    },
    {
      "cve": "CVE-2026-34059",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A buffer over-read vulnerability in Apache HTTP Server versions up to 2.4.66 has been addressed in version 2.4.67, requiring users to upgrade to resolve the issue.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-34059 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34059.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-34059"
    }
  ]
}

OPENSUSE-SU-2026:10785-1

Vulnerability from csaf_opensuse - Published: 2026-05-16 00:00 - Updated: 2026-05-16 00:00

Summary

apache2-2.4.67-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: apache2-2.4.67-1.1 on GA media

Description of the patch: These are all security issues fixed in the apache2-2.4.67-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10785

CVE-2026-23918

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-24072

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-28780

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-29168

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-29169

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-33006

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-33007

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-33523

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-33857

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-34032

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-34059

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64	—	Vendor Fix

Threats

Impact important

References

35 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-23918/	self
https://www.suse.com/security/cve/CVE-2026-24072/	self
https://www.suse.com/security/cve/CVE-2026-28780/	self
https://www.suse.com/security/cve/CVE-2026-29168/	self
https://www.suse.com/security/cve/CVE-2026-29169/	self
https://www.suse.com/security/cve/CVE-2026-33006/	self
https://www.suse.com/security/cve/CVE-2026-33007/	self
https://www.suse.com/security/cve/CVE-2026-33523/	self
https://www.suse.com/security/cve/CVE-2026-33857/	self
https://www.suse.com/security/cve/CVE-2026-34032/	self
https://www.suse.com/security/cve/CVE-2026-34059/	self
https://www.suse.com/security/cve/CVE-2026-23918	external
https://bugzilla.suse.com/1263957	external
https://www.suse.com/security/cve/CVE-2026-24072	external
https://bugzilla.suse.com/1263935	external
https://www.suse.com/security/cve/CVE-2026-28780	external
https://bugzilla.suse.com/1264163	external
https://www.suse.com/security/cve/CVE-2026-29168	external
https://bugzilla.suse.com/1264150	external
https://www.suse.com/security/cve/CVE-2026-29169	external
https://bugzilla.suse.com/1263956	external
https://www.suse.com/security/cve/CVE-2026-33006	external
https://bugzilla.suse.com/1263955	external
https://www.suse.com/security/cve/CVE-2026-33007	external
https://bugzilla.suse.com/1263954	external
https://www.suse.com/security/cve/CVE-2026-33523	external
https://bugzilla.suse.com/1263953	external
https://www.suse.com/security/cve/CVE-2026-33857	external
https://bugzilla.suse.com/1263952	external
https://www.suse.com/security/cve/CVE-2026-34032	external
https://bugzilla.suse.com/1263951	external
https://www.suse.com/security/cve/CVE-2026-34059	external
https://bugzilla.suse.com/1263950	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "apache2-2.4.67-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the apache2-2.4.67-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10785",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10785-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23918 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23918/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24072 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24072/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-28780 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-28780/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-29168 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-29168/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-29169 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-29169/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33006 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33006/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33007 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33007/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33523 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33523/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33857 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33857/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34032 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34032/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34059 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34059/"
      }
    ],
    "title": "apache2-2.4.67-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-05-16T00:00:00Z",
      "generator": {
        "date": "2026-05-16T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10785-1",
      "initial_release_date": "2026-05-16T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-16T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.67-1.1.aarch64",
                "product": {
                  "name": "apache2-2.4.67-1.1.aarch64",
                  "product_id": "apache2-2.4.67-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.67-1.1.ppc64le",
                "product": {
                  "name": "apache2-2.4.67-1.1.ppc64le",
                  "product_id": "apache2-2.4.67-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.67-1.1.s390x",
                "product": {
                  "name": "apache2-2.4.67-1.1.s390x",
                  "product_id": "apache2-2.4.67-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.67-1.1.x86_64",
                "product": {
                  "name": "apache2-2.4.67-1.1.x86_64",
                  "product_id": "apache2-2.4.67-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.67-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64"
        },
        "product_reference": "apache2-2.4.67-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.67-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le"
        },
        "product_reference": "apache2-2.4.67-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.67-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x"
        },
        "product_reference": "apache2-2.4.67-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.67-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        },
        "product_reference": "apache2-2.4.67-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-23918",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23918"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.\n\nThis issue affects Apache HTTP Server: 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23918",
          "url": "https://www.suse.com/security/cve/CVE-2026-23918"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263957 for CVE-2026-23918",
          "url": "https://bugzilla.suse.com/1263957"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-23918"
    },
    {
      "cve": "CVE-2026-24072",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24072"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24072",
          "url": "https://www.suse.com/security/cve/CVE-2026-24072"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263935 for CVE-2026-24072",
          "url": "https://bugzilla.suse.com/1263935"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-24072"
    },
    {
      "cve": "CVE-2026-28780",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-28780"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\nIf mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-28780",
          "url": "https://www.suse.com/security/cve/CVE-2026-28780"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264163 for CVE-2026-28780",
          "url": "https://bugzilla.suse.com/1264163"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-28780"
    },
    {
      "cve": "CVE-2026-29168",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-29168"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server\u0027s   mod_md via OCSP response data.\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-29168",
          "url": "https://www.suse.com/security/cve/CVE-2026-29168"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264150 for CVE-2026-29168",
          "url": "https://bugzilla.suse.com/1264150"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-29168"
    },
    {
      "cve": "CVE-2026-29169",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-29169"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.\n\nThe only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.\n\nUsers are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-29169",
          "url": "https://www.suse.com/security/cve/CVE-2026-29169"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263956 for CVE-2026-29169",
          "url": "https://bugzilla.suse.com/1263956"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-29169"
    },
    {
      "cve": "CVE-2026-33006",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33006"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33006",
          "url": "https://www.suse.com/security/cve/CVE-2026-33006"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263955 for CVE-2026-33006",
          "url": "https://bugzilla.suse.com/1263955"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33006"
    },
    {
      "cve": "CVE-2026-33007",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33007"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33007",
          "url": "https://www.suse.com/security/cve/CVE-2026-33007"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263954 for CVE-2026-33007",
          "url": "https://bugzilla.suse.com/1263954"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33007"
    },
    {
      "cve": "CVE-2026-33523",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33523"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.\n\nThis issue affects Apache HTTP Server: from through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33523",
          "url": "https://www.suse.com/security/cve/CVE-2026-33523"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263953 for CVE-2026-33523",
          "url": "https://bugzilla.suse.com/1263953"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33523"
    },
    {
      "cve": "CVE-2026-33857",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33857"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Out-of-bounds Read vulnerability in mod_proxy_ajp of \n\nApache HTTP Server.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33857",
          "url": "https://www.suse.com/security/cve/CVE-2026-33857"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263952 for CVE-2026-33857",
          "url": "https://bugzilla.suse.com/1263952"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33857"
    },
    {
      "cve": "CVE-2026-34032",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34032"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34032",
          "url": "https://www.suse.com/security/cve/CVE-2026-34032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263951 for CVE-2026-34032",
          "url": "https://bugzilla.suse.com/1263951"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34032"
    },
    {
      "cve": "CVE-2026-34059",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34059"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer Over-read vulnerability in Apache HTTP Server.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
          "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34059",
          "url": "https://www.suse.com/security/cve/CVE-2026-34059"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263950 for CVE-2026-34059",
          "url": "https://bugzilla.suse.com/1263950"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.aarch64",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.ppc64le",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.s390x",
            "openSUSE Tumbleweed:apache2-2.4.67-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34059"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-28780 (GCVE-0-2026-28780)

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from bitnami_vulndb

Solutions

Tags

Sightings

Nomenclature