SB2026111402 - Gentoo update for Apache HTTPD
Published: November 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 23 vulnerabilities.
1) Improper privilege management (CVE-ID: CVE-2026-59797)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain unintended privileges.
The vulnerability exists due to improper privilege management in mod_ssl SSLRequire when processing file-related expressions in .htaccess files. A local user can use file-related expressions in an .htaccess file to gain unintended privileges.
2) Race condition (CVE-ID: CVE-2026-119618)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper synchronization of a shared resource in mod_http2's assign_headers() function when processing requests concurrently. A remote attacker can trigger concurrent access to the shared resource to corrupt heap memory and potentially execute arbitrary code.
3) Stack-based buffer overflow (CVE-ID: CVE-2026-109163)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt stack memory and potentially cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in mod_vhost_alias when handling request data. A remote attacker can supply crafted input to overwrite one byte of stack memory and potentially cause a denial of service.
4) NULL pointer dereference (CVE-ID: CVE-2026-106023)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by crashing a child process.
The vulnerability exists due to a null pointer dereference in mod_md when processing HTTP requests. A remote attacker can send a crafted HTTP request to trigger the dereference and crash a child process.
5) Integer overflow (CVE-ID: CVE-2026-93546)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service and corrupt a directory's property database.
The vulnerability exists due to an integer overflow in mod_dav_fs when processing PROPPATCH requests declaring many XML namespaces. A remote user can send a crafted PROPPATCH request to cause a denial of service and corrupt a directory's property database.
Write access to WebDAV resources is required.
6) Path traversal (CVE-ID: CVE-2026-79768)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper path canonicalization in the mod_userdir module when handling requests containing a "/./" path. A remote attacker can send a specially crafted request to disclose sensitive information.
Only configurations using an absolute non-wildcard UserDir directive are affected.
7) Use-after-free (CVE-ID: CVE-2026-73637)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in mod_auth_digest when processing concurrent Digest authentication requests. A remote attacker can send concurrent Digest authentication requests to cause a denial of service.
The issue occurs when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
8) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-73636)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper handling of one-time nonces in mod_auth_digest when AuthDigestNonceLifetime is set to 0. A remote attacker can replay captured digest authentication credentials in crafted requests that trigger garbage collection of the client's shared-memory entry to bypass authentication.
Exploitation requires a man-in-the-middle position.
9) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-63718)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP response smuggling.
The vulnerability exists due to inconsistent interpretation of HTTP responses in mod_proxy_uwsgi when processing a crafted uwsgi response with a Transfer-Encoding header. A remote attacker can send a crafted uwsgi response to perform HTTP response smuggling.
10) NULL pointer dereference (CVE-ID: CVE-2026-63686)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in mod_xml2enc when processing a proxied response with a charset conversion that partially succeeds and then fails. A remote attacker can provide a specially crafted proxied response to cause a denial of service.
11) Stack-based buffer overflow (CVE-ID: CVE-2026-63292)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.
The vulnerability exists due to a stack-based buffer overflow in mod_vhost_alias when processing an HTTP request with a Host header exceeding 8192 bytes. A remote attacker can send a specially crafted HTTP request to cause a denial of service or potentially execute arbitrary code.
Exploitation requires VirtualDocumentRoot to use a hostname format specifier and LimitRequestFieldSize to be raised above its default value.
12) Input validation error (CVE-ID: CVE-2026-63045)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause the proxy to open a data connection to an arbitrary third-party host.
The vulnerability exists due to improper input validation in mod_proxy_ftp PASV reply address handling when processing a crafted PASV response from an untrusted FTP server. A remote attacker can send a crafted PASV response to cause the proxy to open a data connection to an arbitrary third-party host.
The issue is limited to forward proxy configurations.
13) Interpretation Conflict (CVE-ID: CVE-2026-42356)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to incorrect handler deployment in Apache HTTP Server when processing internal redirects from CGI programs to non-CGI files in CGI-enabled directories. A remote attacker can trigger an internal redirect from a CGI program to execute arbitrary code.
The target file must not have an extension understood by mod_mime.
14) Out-of-bounds write (CVE-ID: CVE-2026-59685)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in the ap_directory_walk() canonical-name rewrite logic when processing paths containing 8.3 names that grow when expanded. A remote attacker can supply a path containing an 8.3 name that expands to cause memory corruption.
The issue occurs on Windows.
15) Improper access control (CVE-ID: CVE-2026-58415)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose WebDAV dead properties of resources they cannot author.
The vulnerability exists due to improper access control in mod_dav_fs when requesting the .DAV state directory through a GET request. A remote attacker can send a GET request for the .DAV state directory to disclose WebDAV dead properties of resources they cannot author.
16) Use-after-free (CVE-ID: CVE-2026-57941)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to use-after-free in mod_http2 when re-entering operations involving shared session->bbtmp. A remote attacker can trigger re-entrancy involving shared session->bbtmp to cause memory corruption.
17) Out-of-bounds write (CVE-ID: CVE-2026-56449)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in the mod_proxy_html dump_content component when processing crafted HTTP response bodies. A remote attacker can supply a crafted HTTP response body to cause a denial of service.
18) Use-after-free (CVE-ID: CVE-2026-56154)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free condition.
The vulnerability exists due to use-after-free in mod_rewrite when using lookahead (%{LA-U:HTTP:...}). A remote attacker can invoke the lookahead functionality to trigger a use-after-free condition.
19) Out-of-bounds write (CVE-ID: CVE-2026-56153)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write beyond allocated memory.
The vulnerability exists due to an out-of-bounds write in mod_charset_lite's finish_partial_char function when processing crafted input. A remote attacker can provide crafted input to write beyond allocated memory.
20) Missing Authentication for Critical Function (CVE-ID: CVE-2026-48005)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through forced re-authentication.
The vulnerability exists due to missing authentication checks in mod_auth_digest when processing forged Authorization headers. A remote attacker can send forged Authorization headers to cause a denial of service through forced re-authentication.
Digest authentication must be enabled with AuthDigestNcCheck.
21) Information disclosure (CVE-ID: CVE-2026-47360)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper session cookie removal in the mod_session_cookie module when SessionCookieRemove changes across internal redirects. A remote attacker can send a request that triggers an internal redirect to disclose sensitive information.
The session cookie may still be passed to a backend server.
22) NULL pointer dereference (CVE-ID: CVE-2026-46729)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in mod_heartmonitor when processing traffic received over a unicast listener. A remote attacker can send traffic to the unicast listener to cause a denial of service.
23) Incorrect calculation (CVE-ID: CVE-2026-42528)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an incorrect memory calculation in mod_dav when creating WebDAV locks. A remote user can create WebDAV locks to cause a denial of service.
Remediation
Install update from vendor's website.