Apache HTTP Server notices mix new bugs and older flaws

October 2026 Apache notices describe low and moderate HTTP Server bugs through 2.4.68; a later report also cites 2024 flaws and urges 2.4.68.

On 1 October 2026, oss-security disclosed two Apache HTTP Server issues affecting releases through 2.4.68: low-severity CVE-2026-79768, a mod_userdir information disclosure from 2.4.0 credited to Vlatko, and moderate CVE-2026-93546, an integer overflow in mod_dav_fs. For CVE-2026-93546, an authenticated WebDAV client with write access can crash worker processes and persistently corrupt a directory's property database; credit went to Zhen Kong of Calif.io, with Anthropic and AISLE. Neither oss-security note reports exploitation in the wild. A 2 October GBHackers article says Apache documents flaws that can lead to remote code execution, information disclosure, or denial of service, and it recommends upgrading to 2.4.68 and auditing exposed modules. That report cites CVE-2024-38475, CVE-2024-38474, and CVE-2024-38476, fixed in 2.4.60, plus CVE-2026-49975 in 2.4.17 through 2.4.67 and fixed in 2.4.68, CVE-2026-44186, and CVE-2026-42535, also with no reported exploitation. The sources disagree on 2.4.68, which oss-security treats as still affected for its two CVEs while GBHackers presents it as the urged fix, and they cite different WebDAV identifiers without equating them.

• CVE-2026-79768 is a low-severity mod_userdir information disclosure affecting Apache HTTP Server 2.4.0 through 2.4.68; oss-security credits finder Vlatko and reports no exploitation.
• CVE-2026-93546 is a moderate integer overflow in mod_dav_fs affecting Apache HTTP Server through 2.4.68; an authenticated WebDAV writer can crash workers and persistently corrupt a directory property database.
• CVE-2026-93546 is credited to Zhen Kong of Calif.io, in collaboration with Anthropic, and AISLE; the notice reports no in-the-wild exploitation.
• GBHackers lists moderate mod_http2 memory-exhaustion CVE-2026-49975 in versions 2.4.17 through 2.4.67, fixed in 2.4.68, plus mod_proxy_ftp infinite-loop CVE-2026-44186 and WebDAV crash CVE-2026-42535.
• GBHackers also cites CVE-2024-38475, CVE-2024-38474, and CVE-2024-38476, fixed in 2.4.60, which may allow code execution, unintended script access, SSRF, or source disclosure depending on configuration.
• Sources disagree on 2.4.68: oss-security says CVE-2026-79768 and CVE-2026-93546 affect releases through 2.4.68, while GBHackers urges upgrading to 2.4.68.
• The reports name different WebDAV issues, CVE-2026-93546 and CVE-2026-42535, without stating they are the same bug; none reports exploitation.