CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Apache HTTP Server 2.4.0 through 2.4.68 can leak session cookies to backends across internal redirects.
Eric Covener disclosed CVE-2026-47360, a low-severity information-exposure flaw in Apache HTTP Server's mod_session_cookie. If SessionCookieRemove changes across an internal redirect, the session cookie may still be forwarded to a backend. Versions 2.4.0 through 2.4.68 are affected. Finder credit is lokerxx; the advisory does not describe active exploitation.
- Affects Apache HTTP Server 2.4.0 through 2.4.68.
- mod_session_cookie may forward a session cookie after an internal redirect.
- Vendor rates the issue low; no exploitation is reported.
Vulnerabilities mentionedAll →
- CVE-2026-473607.5—Session cookie leak in Apache HTTP Server mod_session_cookiepublished · Apache HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-47360 | Session cookie leak in Apache HTTP Server mod_session_cookie Apache HTTP Server's mod_session_cookie module can expose a session cookie to a backend server when the SessionCookieRemove setting changes across an internal redirect. The cookie that should have been stripped is still forwarded, disclosing sensitive session data to an unauthorized actor on that backend. The flaw is a confidentiality issue (CWE-200) reachable over the network with no authentication or user interaction (CVSS 3.1 score 7.5). It affects Apache HTTP Server 2.4.0 through 2.4.68 where this module and redirect behavior are in use. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known. Do: Upgrade Apache HTTP Server to a release that fixes CVE-2026-47360; versions 2.4.0 through 2.4.68 are affected, so confirm the exact fixed release in the Apache security advisory before upgrading. Until then, review any use of mod_session_cookie where SessionCookieRemove changes across internal redirects or reverse-proxy paths, and stop session cookies from being forwarded to backend servers. Check backend requests for unexpected Cookie headers that carry session data. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Credit: lokerxx (finder)...
This source does not provide full text. Read it at seclists.org.