CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

CVE-2026-56153 is an out-of-bounds write (CWE-787), described as a heap overflow in the finish_partial_char function of Apache HTTP Server's mod_charset_lite module. It affects Apache HTTP Server versions 2.4.0 through 2.4.68. An attacker who can reach the module's partial-character handling may corrupt heap memory, which can crash the server process and, depending on memory layout, may allow further exploitation. Only deployments that load and use mod_charset_lite are on the vulnerable code path. No public proof of concept is known, the issue is not in CISA KEV, exploitation in the wild is not known, and CVSS has not yet been scored.

Do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as the Apache project publishes a fix, and follow the official advisory for the exact fixed version rather than assuming one. Until then, unload or disable mod_charset_lite if character-set translation is not required. After any change, confirm the running version and that the module is no longer loaded.