CVE-2026-59685: Out-of-Bounds Write in Apache HTTP Server on Windows · ZeroHour

CVE-2026-59685

large

Out-of-Bounds Write in Apache HTTP Server on Windows

CVSS 3.1

7.5 high

EPSS

—

Published

Oct 1, 2026 (15d ago)

Modified

Oct 5, 2026

AI analysis

CVE-2026-59685 is an out-of-bounds write (CWE-787) in Apache HTTP Server on Windows, in ap_directory_walk() while rewriting a path to its canonical name on a case-blind filesystem. It is triggered when the server processes paths that use 8.3 short names which can grow longer when expanded. An out-of-bounds write can corrupt memory and crash the server process; the advisory does not state that remote code execution has been demonstrated. Every Apache HTTP Server release from 2.4.0 through 2.4.68 on Windows is affected; non-Windows builds are outside the described issue. CVSS is not yet scored, it is not in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Windows installations of Apache HTTP Server to a release newer than 2.4.68 as soon as Apache publishes it. Until then, reduce exposure of Windows httpd to untrusted networks and, where operationally acceptable, disable Windows 8.3 short-name generation on volumes that serve web content.

Affected

Apache HTTP Server

2.4.0 through 2.4.68 on Windows

Estimated exposure

largeon the order of 10,000–100,000 Windows installations — Apache HTTP Server is one of the most widely deployed web servers, but this flaw is limited to Windows (8.3 names and a case-blind filesystem); public scan and market data imply Windows is a minority of that install base, so affected…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Vendors: apache
Products: http server
Weakness: CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-59685

In the news2 stories

Multiple Apache HTTP Server Vulnerabilities Could Enable Code Execution Attacks

CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM