AI analysis
Apache HTTP Server's mod_session_cookie module can expose a session cookie to a backend server when the SessionCookieRemove setting changes across an internal redirect. The cookie that should have been stripped is still forwarded, disclosing sensitive session data to an unauthorized actor on that backend. The flaw is a confidentiality issue (CWE-200) reachable over the network with no authentication or user interaction (CVSS 3.1 score 7.5). It affects Apache HTTP Server 2.4.0 through 2.4.68 where this module and redirect behavior are in use. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Upgrade Apache HTTP Server to a release that fixes CVE-2026-47360; versions 2.4.0 through 2.4.68 are affected, so confirm the exact fixed release in the Apache security advisory before upgrading. Until then, review any use of mod_session_cookie where SessionCookieRemove changes across internal redirects or reverse-proxy paths, and stop session cookies from being forwarded to backend servers. Check backend requests for unexpected Cookie headers that carry session data.
Affected
| Apache HTTP Server | 2.4.0 through 2.4.68 |
Estimated exposure
massmillions of Apache HTTP Server 2.4 installs contain the code; practical exposure is the subset using mod_session_cookie with SessionCookieRemove across… — Public web-server surveys place Apache HTTP Server on a large share of internet sites, on the order of millions to tens of millions of hosts, but this flaw only occurs when mod_session_cookie is used and SessionCookieRemove changes across…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.