Story · 1 source · 10 articlesfirst Oct 1, 18:39 UTCupdated Oct 1, 18:56 UTC (15d ago)

Apache discloses HTTP Server and Traffic Server flaws

highVulnerabilityimportance 62CVE-2024-38475 CVE-2024-38474 CVE-2024-38476 CVE-2026-49975 CVE-2026-44186 CVE-2026-42535 CVE-2026-63292 CVE-2026-57941

What's new: First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrives

Apache disclosed HTTP Server flaws through 2.4.68, with 2.4.69 advised for some, plus a Traffic Server SNI-matching fix.

On 1 October 2026, oss-security notices described several Apache HTTP Server flaws affecting releases through 2.4.68, with 2.4.69 explicitly recommended for CVE-2026-63686 and CVE-2026-73637. Moderate issues are CVE-2026-57941 in mod_http2, Windows-only CVE-2026-59685 in ap_directory_walk(), CVE-2026-63292 in mod_vhost_alias, and CVE-2026-93546 in mod_dav_fs. Low-severity issues are a mod_xml2enc crash, mod_proxy_uwsgi response smuggling, and two mod_auth_digest flaws involving credential replay and authentication-state corruption under specific settings. A 2 October GBHackers report disagrees on both the CVE set and the recommended release: it highlights CVE-2024-38474, CVE-2024-38475, and CVE-2024-38476, fixed in 2.4.60, plus CVE-2026-49975, CVE-2026-44186, and CVE-2026-42535, and urges an upgrade to 2.4.68. Separately, moderate Apache Traffic Server CVE-2026-102795 supersedes CVE-2026-41920 and is fixed in 9.2.15 and 10.1.4; no notice reports exploitation in the wild.

CVE-2026-57941 is a moderate mod_http2 use-after-free and wild write via re-entrancy of the shared session->bbtmp buffer; exploitation was not reported.
CVE-2026-59685 is a moderate out-of-bounds write in ap_directory_walk() on Windows in Apache HTTP Server 2.4.0 through 2.4.68 when 8.3 names expand; credited to Dhiraj Mishra and Feng Ning of Innora.
CVE-2026-63292 is a moderate mod_vhost_alias stack overflow in 2.4.0 through 2.4.68: a Host header longer than 8192 bytes may cause denial of service or code execution when VirtualDocumentRoot uses a hostname specifier.
Low-severity issues through 2.4.68 include CVE-2026-63686 (mod_xml2enc NULL dereference; upgrade to 2.4.69), CVE-2026-63718 (mod_proxy_uwsgi Transfer-Encoding smuggling in 2.4.30–2.4.68, finder Qing Xu), CVE-2026-73636 (mod_auth_digest…
CVE-2026-93546 is a moderate mod_dav_fs integer overflow through 2.4.68; an authenticated WebDAV writer can crash workers and corrupt property data. Credit: Zhen Kong of Calif.io, with Anthropic, and AISLE.
GBHackers instead cites CVE-2024-38474, CVE-2024-38475, and CVE-2024-38476 (fixed in 2.4.60), CVE-2026-49975 (2.4.17–2.4.67, fixed in 2.4.68), CVE-2026-44186, and CVE-2026-42535, and recommends 2.4.68 rather than 2.4.69.
Moderate Apache Traffic Server CVE-2026-102795, which supersedes CVE-2026-41920, affects 9.0.0–9.2.14 and 10.0.0–10.1.3 and is fixed in 9.2.15 and 10.1.4; SNI-to-Host matching is not properly enforced.
None of the reports say any of these flaws are being exploited in the wild.

VendorsApache Software Foundation Apache

ProductsApache HTTP Server mod_vhost_alias mod_http2 mod_dav_fs Apache Traffic Server mod_proxy_uwsgi mod_auth_digest mod_xml2enc mod_proxy_ftp

OrganizationsApache Software Foundation Innora Security Research Calif.io Anthropic AISLE

Coverage timelineoldest first · each row is one article

Oct 1, 18:39 UTC · 15d ago
oss-security· 60
CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
CVE-2026-57941 is a moderate mod_http2 use-after-free and wild write via session-buffer re-entrancy.
Oct 1, 18:41 UTC · 15d ago
oss-security· 34
CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access
CVE-2026-58415 lets remote clients read WebDAV dead properties from Apache mod_dav_fs state files.
Oct 1, 18:43 UTC · 15d ago
oss-security· 58
CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

Vulnerabilities in this storyAll →

CVE-2024-384759.1100%
Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution
published Jul 1, 2024· Apache HTTP Server KEV+2 related
CVE-2026-1027957.0—
Improper Access Control in Apache Traffic Server

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2024-38475 +2 related CVEs CVE-2024-38476 CVE-2024-38474	Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution CVE-2024-38475 is an improper escaping of output flaw (CWE-116) in the mod_rewrite module of the Apache HTTP Server. It is triggered when mod_rewrite maps a request URL to a filesystem location and mishandles encoded characters, allowing a crafted request to reach files that the server is permitted to serve but that were never intentionally or directly reachable by any URL. An attacker can abuse this to disclose source code (for example, serving raw application files) or, depending on the server's configuration and handlers, achieve code execution. Any Apache HTTP Server deployment that uses mod_rewrite is potentially affected; the source data does not specify the vulnerable version range. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, confirming exploitation in the wild, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Inventory Apache HTTP Server deployments, prioritize internet-facing ones, and check whether mod_rewrite is in use (RewriteRule directives in server config, virtual hosts, or .htaccess files); upgrade to the vendor's fixed release, 2.4.60 or later. If immediate upgrade is not possible, follow vendor guidance to harden or constrain mod_rewrite rules, and treat the issue as actively exploited per CISA KEV, applying BOD 22-01 mitigations for cloud service usage or discontinuing use if mitigation is unavailable.	9.1 group max	100%	KEV	Apache HTTP Server Version range not specified in source data; deployments with mod_rewrite enabled prior to the vendor's fixed release (2.4.60 per vendor advisory) are affected	masslikely hundreds of thousands to over a million internet-exposed Apache HTTP Server instances, with only the mod_rewrite-enabled subset vulnerable	Jul 1, 2024 KEV May 1, 2025
CVE-2026-102795	Improper Access Control in Apache Traffic Server Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contain an improper access control flaw (CWE-284). The issue is reachable over the network without authentication or user interaction, though some attack preconditions apply, and the published severity is high (CVSS 4.0 base score 7). Impact is scored against subsequent systems rather than the Traffic Server process itself, with high confidentiality and integrity impact and no availability impact indicated. Operators of Apache Traffic Server in those ranges are affected; this record corrects CVE-2026-41920, which understated the 9.x range and named the wrong fixed 9.x release. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Upgrade Apache Traffic Server to 9.2.15 or 10.1.4. Treat every 9.x release from 9.0.0 through 9.2.14 as vulnerable, including all 9.2.x builds before 9.2.15; do not rely on the narrower range in superseded CVE-2026-41920. After upgrading, confirm the running version and review access-control and proxy rules for unexpected exposure of backend systems.	7.0	—		Apache Software Foundation Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3	moderatethousands to low tens of thousands of deployments	14d ago
CVE-2026-41920	Improper Access Control vulnerability in Apache Traffic Server Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue. NVD description · AI analysis pending	7.0	<1%		apache traffic server	—	Jul 29, 2026
CVE-2026-42535 +2 related CVEs CVE-2026-49975 CVE-2026-44186	A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases… A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue. NVD description · AI analysis pending	9.1 group max	<1%		apache http server	—	Jun 8, 2026
CVE-2026-57941 +9 related CVEs CVE-2026-93546 CVE-2026-73636 CVE-2026-63292 CVE-2026-59685 CVE-2026-63045 CVE-2026-63686 CVE-2026-63718 CVE-2026-73637 CVE-2026-58415	Use-after-free in Apache HTTP Server mod_http2 CVE-2026-57941 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_http2 module, caused by re-entrancy on a shared session->bbtmp buffer that can lead to a wild write. It is triggered through the HTTP/2 handling path when that shared buffer is reused unsafely; the published data does not describe a specific request sequence or confirm remote code execution. An attacker who can exercise the flawed path may corrupt memory in the server process, with impact ranging from a crash to possible further memory corruption, depending on how the freed buffer is reused. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that has mod_http2 loaded is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored. Do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as the Apache project publishes a fix, and confirm the running build is no longer in the 2.4.0–2.4.68 range. Until then, unload mod_http2 if HTTP/2 is not required (check with httpd -M or apachectl -M) and follow the Apache security advisory for this CVE. There is no public proof-of-concept and it is not listed in CISA KEV, but treat internet-facing servers that load mod_http2 as priority.	9.8 group max

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2024-38475

+2 related CVEs

CVE-2024-38476 CVE-2024-38474

Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution

CVE-2024-38475 is an improper escaping of output flaw (CWE-116) in the mod_rewrite module of the Apache HTTP Server. It is triggered when mod_rewrite maps a request URL to a filesystem location and mishandles encoded characters, allowing a crafted request to reach files that the server is permitted to serve but that were never intentionally or directly reachable by any URL. An attacker can abuse this to disclose source code (for example, serving raw application files) or, depending on the server's configuration and handlers, achieve code execution. Any Apache HTTP Server deployment that uses mod_rewrite is potentially affected; the source data does not specify the vulnerable version range. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, confirming exploitation in the wild, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Inventory Apache HTTP Server deployments, prioritize internet-facing ones, and check whether mod_rewrite is in use (RewriteRule directives in server config, virtual hosts, or .htaccess files); upgrade to the vendor's fixed release, 2.4.60 or later. If immediate upgrade is not possible, follow vendor guidance to harden or constrain mod_rewrite rules, and treat the issue as actively exploited per CISA KEV, applying BOD 22-01 mitigations for cloud service usage or discontinuing use if mitigation is unavailable.

9.1

group max

100%

KEV

Apache HTTP Server Version range not specified in source data; deployments with mod_rewrite enabled prior to the vendor's fixed release (2.4.60 per vendor advisory) are affected

masslikely hundreds of thousands to over a million internet-exposed Apache HTTP Server instances, with only the mod_rewrite-enabled subset vulnerable

Jul 1, 2024

KEV May 1, 2025

CVE-2026-102795

Improper Access Control in Apache Traffic Server

Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contain an improper access control flaw (CWE-284). The issue is reachable over the network without authentication or user interaction, though some attack preconditions apply, and the published severity is high (CVSS 4.0 base score 7). Impact is scored against subsequent systems rather than the Traffic Server process itself, with high confidentiality and integrity impact and no availability impact indicated. Operators of Apache Traffic Server in those ranges are affected; this record corrects CVE-2026-41920, which understated the 9.x range and named the wrong fixed 9.x release. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade Apache Traffic Server to 9.2.15 or 10.1.4. Treat every 9.x release from 9.0.0 through 9.2.14 as vulnerable, including all 9.2.x builds before 9.2.15; do not rely on the narrower range in superseded CVE-2026-41920. After upgrading, confirm the running version and review access-control and proxy rules for unexpected exposure of backend systems.

7.0

—

Apache Software Foundation Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3

moderatethousands to low tens of thousands of deployments

14d ago

CVE-2026-41920

Improper Access Control vulnerability in Apache Traffic Server

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

NVD description · AI analysis pending

7.0

<1%

apache traffic server

—

Jul 29, 2026

CVE-2026-42535

+2 related CVEs

CVE-2026-49975 CVE-2026-44186

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases…

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

NVD description · AI analysis pending

9.1

group max

<1%

apache http server

—

Jun 8, 2026

CVE-2026-57941

Use-after-free in Apache HTTP Server mod_http2

CVE-2026-57941 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_http2 module, caused by re-entrancy on a shared session->bbtmp buffer that can lead to a wild write. It is triggered through the HTTP/2 handling path when that shared buffer is reused unsafely; the published data does not describe a specific request sequence or confirm remote code execution. An attacker who can exercise the flawed path may corrupt memory in the server process, with impact ranging from a crash to possible further memory corruption, depending on how the freed buffer is reused. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that has mod_http2 loaded is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.

Do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as the Apache project publishes a fix, and confirm the running build is no longer in the 2.4.0–2.4.68 range. Until then, unload mod_http2 if HTTP/2 is not required (check with httpd -M or apachectl -M) and follow the Apache security advisory for this CVE. There is no public proof-of-concept and it is not listed in CISA KEV, but treat internet-facing servers that load mod_http2 as priority.

9.8

group max