This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache HTTP Server fixes 11 vulnerabilities
Apache fixes 11 vulnerabilities in Apache HTTP Server with version 2.4.67 [1]. Debian releases fixing the vulnerability CVE-2026-23918 [2]: bullseye - 2.4.62-1~deb11u1 bullseye (security) - 2.4.66-1~deb11u1 bookworm (security) - 2.4.67-1~deb12u2 trixie - 2.4.66-1~deb13u2 trixie (security) - 2.4.67-1~deb13u2 forky - 2.4.66-8 sid - 2.4.67-1 Debian releases fixing the other vulnerabilities [3]: bookworm (security) - 2.4.67-1~deb12u2 trixie (security) - 2.4.67-1~deb13u2 Ubuntu releases and their fixed releases [4][5]: resolute - 2.4.66-2ubuntu2.1 questing - 2.4.64-1ubuntu3.4 noble - 2.4.58-1ubuntu8.12 jammy - 2.4.52-1ubuntu4.20
An unauthenticated remote attacker is potentially able to execute code on the vulnerable machine due to a flaw involving repeated freeing of the same memory region [6].
The vulnerability is present in product:
- Apache HTTP; >=2.4.66, <2.4.67;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-23918 at cve.org, NVD
- CWE-415: Double Free at cwe.mitre.org
The vulnerability was publicly disclosed 4. 5. 2026.
An unauthenticated remote attacker is able to carry out a DoS attack against an instance with a forward proxy with cache enabled [7].
The vulnerability is present in product:
- Apache HTTP; >=2.4.0, <2.4.67;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2026-33007 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 4. 5. 2026.
An unauthenticated remote attacker is able, by means of a timing attack, to gradually guess the correct digest value and subsequently authenticate with it [7].
The vulnerability is present in product:
- Apache HTTP; >=2.4.66, <2.4.67;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
More information:
- CVE-2026-33006 at cve.org, NVD
- CWE-208: Observable Timing Discrepancy at cwe.mitre.org
The vulnerability was publicly disclosed 4. 5. 2026.
Links
- [1] https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-23918
- [2] https://security-tracker.debian.org/tracker/CVE-2026-23918
- [3] https://security-tracker.debian.org/tracker/DSA-6248-1
- [4] https://ubuntu.com/security/CVE-2026-23918
- [5] https://ubuntu.com/security/notices/USN-8239-1
- [6] https://www.cve.org/CVERecord?id=CVE-2026-23918
- [7] https://httpd.apache.org/security/vulnerabilities_24.html
By CESNET, z.s.p.o. Martin Krajči on 7. 5. 2026.