This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache fixes 13 vulnerabilities
Apache fixes 13 vulnerabilities in Apache HTTP Server with version 2.4.68. The most severe vulnerabilities are described below, the remaining ones can be found at [1]. The CVE-2026-49975 vulnerability has already been reported in the past and its description can be found at [2]. Debian releases fixing the CVE-2026-49975 vulnerability [3]: bookworm (security) - 2.4.67-1~deb12u3 trixie (security) - 2.4.67-1~deb13u3 Debian releases fixing the other vulnerabilities [4]: bullseye (security) - 2.4.67-1~deb11u3 forky, sid - 2.4.68-1 Red Hat releases fixing CVE-2026-49975 can be found at [5]
An authenticated remote attacker with WebDAV content author rights can, due to a path handling error in the WebDAV file system management module, directly manipulate trusted DAV property databases and thereby compromise data integrity or cause a DoS on the vulnerable machine [1].
The vulnerability is present in product:
- Apache HTTP Server; <= 2.4.67;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
More information:
- CVE-2026-42535 at cve.org, NVD
- CWE-668: Exposure of Resource to Wrong Sphere at cwe.mitre.org
The vulnerability was publicly disclosed 8. 6. 2026.
An unauthenticated remote attacker can potentially cause a DoS or achieve RCE on the vulnerable machine due to an out-of-bounds write error when processing specially crafted regular expressions in the configuration [1].
The vulnerability is present in product:
- Apache HTTP Server; >=2.4.0, <=2.4.67;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-44631 at cve.org, NVD
- CWE-124: Buffer Underwrite ('Buffer Underflow') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 6. 2026.
An unauthenticated remote attacker can potentially cause a DoS or achieve RCE on the vulnerable machine due to a use-after-free error in the mod_ldap module in a per-directory configuration [1].
The vulnerability is present in product:
- Apache HTTP Server; >=2.4.0, <=2.4.67;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-29167 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 8. 6. 2026.
Links
By CESNET, z.s.p.o. Táňa Macháčková on 17. 6. 2026.