SB2026101563 - Anolis OS update for httpd
Published: October 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Interpretation Conflict (CVE-ID: CVE-2026-42356)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to incorrect handler deployment in Apache HTTP Server when processing internal redirects from CGI programs to non-CGI files in CGI-enabled directories. A remote attacker can trigger an internal redirect from a CGI program to execute arbitrary code.
The target file must not have an extension understood by mod_mime.
2) Incorrect calculation (CVE-ID: CVE-2026-42528)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an incorrect memory calculation in mod_dav when creating WebDAV locks. A remote user can create WebDAV locks to cause a denial of service.
3) NULL pointer dereference (CVE-ID: CVE-2026-46729)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in mod_heartmonitor when processing traffic received over a unicast listener. A remote attacker can send traffic to the unicast listener to cause a denial of service.
4) Information disclosure (CVE-ID: CVE-2026-47360)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper session cookie removal in the mod_session_cookie module when SessionCookieRemove changes across internal redirects. A remote attacker can send a request that triggers an internal redirect to disclose sensitive information.
The session cookie may still be passed to a backend server.
5) Missing Authentication for Critical Function (CVE-ID: CVE-2026-48005)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through forced re-authentication.
The vulnerability exists due to missing authentication checks in mod_auth_digest when processing forged Authorization headers. A remote attacker can send forged Authorization headers to cause a denial of service through forced re-authentication.
Digest authentication must be enabled with AuthDigestNcCheck.
6) Out-of-bounds write (CVE-ID: CVE-2026-56153)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write beyond allocated memory.
The vulnerability exists due to an out-of-bounds write in mod_charset_lite's finish_partial_char function when processing crafted input. A remote attacker can provide crafted input to write beyond allocated memory.
7) Out-of-bounds write (CVE-ID: CVE-2026-56449)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in the mod_proxy_html dump_content component when processing crafted HTTP response bodies. A remote attacker can supply a crafted HTTP response body to cause a denial of service.
8) Improper access control (CVE-ID: CVE-2026-58415)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose WebDAV dead properties of resources they cannot author.
The vulnerability exists due to improper access control in mod_dav_fs when requesting the .DAV state directory through a GET request. A remote attacker can send a GET request for the .DAV state directory to disclose WebDAV dead properties of resources they cannot author.
9) Input validation error (CVE-ID: CVE-2026-63045)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause the proxy to open a data connection to an arbitrary third-party host.
The vulnerability exists due to improper input validation in mod_proxy_ftp PASV reply address handling when processing a crafted PASV response from an untrusted FTP server. A remote attacker can send a crafted PASV response to cause the proxy to open a data connection to an arbitrary third-party host.
The issue is limited to forward proxy configurations.
10) Stack-based buffer overflow (CVE-ID: CVE-2026-63292)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.
The vulnerability exists due to a stack-based buffer overflow in mod_vhost_alias when processing an HTTP request with a Host header exceeding 8192 bytes. A remote attacker can send a specially crafted HTTP request to cause a denial of service or potentially execute arbitrary code.
Exploitation requires VirtualDocumentRoot to use a hostname format specifier and LimitRequestFieldSize to be raised above its default value.
11) NULL pointer dereference (CVE-ID: CVE-2026-63686)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in mod_xml2enc when processing a proxied response with a charset conversion that partially succeeds and then fails. A remote attacker can provide a specially crafted proxied response to cause a denial of service.
12) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-63718)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP response smuggling.
The vulnerability exists due to inconsistent interpretation of HTTP responses in mod_proxy_uwsgi when processing a crafted uwsgi response with a Transfer-Encoding header. A remote attacker can send a crafted uwsgi response to perform HTTP response smuggling.
13) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-73636)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper handling of one-time nonces in mod_auth_digest when AuthDigestNonceLifetime is set to 0. A remote attacker can replay captured digest authentication credentials in crafted requests that trigger garbage collection of the client's shared-memory entry to bypass authentication.
Exploitation requires a man-in-the-middle position.
14) Use-after-free (CVE-ID: CVE-2026-73637)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in mod_auth_digest when processing concurrent Digest authentication requests. A remote attacker can send concurrent Digest authentication requests to cause a denial of service.
The issue occurs when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
15) Path traversal (CVE-ID: CVE-2026-79768)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper path canonicalization in the mod_userdir module when handling requests containing a "/./" path. A remote attacker can send a specially crafted request to disclose sensitive information.
Only configurations using an absolute non-wildcard UserDir directive are affected.
Remediation
Install update from vendor's website.