CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
CVE-2026-59685 is a moderate Apache HTTP Server out-of-bounds write on Windows when 8.3 names expand.
Apache disclosed CVE-2026-59685, a moderate out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows. The flaw is in ap_directory_walk() while rewriting canonical names for paths whose 8.3 short names may grow when expanded. It was reported by Dhiraj Mishra and Feng Ning of Innora Security Research. The oss-security post does not report exploitation in the wild.
- CVE-2026-59685 is rated moderate by Apache.
- Affects Apache HTTP Server 2.4.0 through 2.4.68 on Windows.
- Out-of-bounds write occurs when expanding 8.3 names in ap_directory_walk.
- Credited to Dhiraj Mishra and Feng Ning of Innora.
Vulnerabilities mentionedAll →
- CVE-2026-596857.5—Out-of-Bounds Write in Apache HTTP Server on Windowspublished · Apache HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-59685 | Out-of-Bounds Write in Apache HTTP Server on Windows CVE-2026-59685 is an out-of-bounds write (CWE-787) in Apache HTTP Server on Windows, in ap_directory_walk() while rewriting a path to its canonical name on a case-blind filesystem. It is triggered when the server processes paths that use 8.3 short names which can grow longer when expanded. An out-of-bounds write can corrupt memory and crash the server process; the advisory does not state that remote code execution has been demonstrated. Every Apache HTTP Server release from 2.4.0 through 2.4.68 on Windows is affected; non-Windows builds are outside the described issue. CVSS is not yet scored, it is not in CISA KEV, and no public proof-of-concept is known. Do: Upgrade Windows installations of Apache HTTP Server to a release newer than 2.4.68 as soon as Apache publishes it. Until then, reduce exposure of Windows httpd to untrusted networks and, where operationally acceptable, disable Windows 8.3 short-name generation on volumes that serve web content. |
Posted by Eric Covener on Oct 01 Severity: moderate Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Credit: Dhiraj Mishra (finder) Feng Ning (innora.ai / Innora Security Research) (finder) References:...
This source does not provide full text. Read it at seclists.org.