CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
Apache mod_ssl through 2.4.68 lets SSLRequire .htaccess expressions call file functions, a low-severity issue.
CVE-2026-59797 is an improper privilege management flaw in Apache HTTP Server mod_ssl, affecting 2.4.0 through 2.4.68. SSLRequire can evaluate file-related ap_expr functions from .htaccess, which Apache rates low severity. Finders credited include kimchunbok, l1nx1n, Juthawong Naisanguansee, Charles Vosburgh, Mike Read, and Ryoma Nishioka.
- Affects Apache HTTP Server 2.4.0 through 2.4.68.
- mod_ssl SSLRequire can use file-related ap_expr functions from .htaccess.
- Apache classifies it as improper privilege management with low severity.
- Multiple independent finders are credited.
Vulnerabilities mentionedAll →
- CVE-2026-597979.8—Privilege flaw in Apache HTTP Server mod_ssl SSLRequirepublished · Apache Software Foundation HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-59797 | Privilege flaw in Apache HTTP Server mod_ssl SSLRequire Apache HTTP Server 2.4.0 through 2.4.68 has an improper privilege management flaw (CWE-269) in mod_ssl involving the SSLRequire directive and file-related expressions. Reporting on CVE-2026-59797 indicates that SSLRequire can allow a .htaccess file to use ap_expr file functions that should not be available in that context. Someone who can place or change .htaccess, or otherwise supply SSLRequire configuration, may cross that privilege boundary and invoke those file-related expressions; remote code execution is not stated. Every deployment still on that 2.4 range is in scope, with practical risk highest where mod_ssl is enabled and untrusted users can write .htaccess. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not been scored. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Credit: kimchunbok (finder) l1nx1n (finder) Juthawong Naisanguansee (finder) Charles Vosburgh (finder) Mike Read (finder) Ryoma Nishioka (finder) References:...
This source does not provide full text. Read it at seclists.org.