AI analysis
CVE-2026-56153 is an out-of-bounds write (CWE-787), described as a heap overflow in the finish_partial_char function of Apache HTTP Server's mod_charset_lite module. It affects Apache HTTP Server versions 2.4.0 through 2.4.68. An attacker who can reach the module's partial-character handling may corrupt heap memory, which can crash the server process and, depending on memory layout, may allow further exploitation. Only deployments that load and use mod_charset_lite are on the vulnerable code path. No public proof of concept is known, the issue is not in CISA KEV, exploitation in the wild is not known, and CVSS has not yet been scored.
What to do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as the Apache project publishes a fix, and follow the official advisory for the exact fixed version rather than assuming one. Until then, unload or disable mod_charset_lite if character-set translation is not required. After any change, confirm the running version and that the module is no longer loaded.
Affected
| Apache Software Foundation HTTP Server | 2.4.0 through 2.4.68 |
Estimated exposure
massmillions of Apache HTTP Server 2.4 installations; only those with mod_charset_lite enabled are directly affected — Apache HTTP Server is one of the most widely deployed web servers; public web surveys and internet scans consistently show millions of exposed Apache instances, while mod_charset_lite is an optional module so only the subset that loads it…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.