CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure
An untrusted backend can crash Apache HTTP Server via a mod_xml2enc NULL pointer dereference.
CVE-2026-63686 is a low-severity NULL pointer dereference in mod_xml2enc affecting Apache HTTP Server 2.4.0 through 2.4.68. An untrusted backend can crash the server with a proxied response whose charset conversion partially succeeds and then fails. Users are advised to upgrade to 2.4.69.
- NULL pointer dereference in mod_xml2enc
- Untrusted backend can cause denial of service
- Fixed in Apache HTTP Server 2.4.69
Vulnerabilities mentionedAll →
- CVE-2026-636867.5—NULL pointer DoS in Apache HTTP Server mod_xml2encpublished · Apache Software Foundation Apache HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63686 | NULL pointer DoS in Apache HTTP Server mod_xml2enc A NULL pointer dereference (CWE-476) in the mod_xml2enc module of Apache HTTP Server before 2.4.69 can crash the server. It is triggered when an untrusted backend, reached through a proxy, returns a response whose charset conversion partially succeeds and then fails. The result is a denial of service on all platforms, not code execution or data theft. Any deployment running a vulnerable release with mod_xml2enc processing proxied responses from an untrusted backend is affected. There is no known public proof of concept, the issue is not on the CISA KEV list, and CVSS has not yet been scored. Do: Upgrade Apache HTTP Server to 2.4.69 or later. Until then, unload mod_xml2enc (check with httpd -M or apachectl -M) or stop using it to recode responses from backends you do not trust, and restart httpd after the change. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue....
This source does not provide full text. Read it at seclists.org.