Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorymedium

Apache HTTP Server flaws hit Ubuntu LTS and versions before 2.4.71

2 sources · 2 articlesFirst reported Updated ()
What's new

November 13: Canada’s AV26-1159 says Apache HTTP Server versions before 2.4.71 are affected and urges updates, without naming CVEs or impact.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Ubuntu and Canadian advisories warn of Apache HTTP Server flaws; versions before 2.4.71 are affected, with no exploitation reported.

Ubuntu security notice USN-9016-1 says incorrect memory handling in Apache HTTP Server could cause denial of service on Ubuntu 14.04 LTS through 26.04 LTS (CVE-2026-46729). A separate session-cookie issue could let a remote attacker leak sensitive information on several of those releases, including 14.04, 16.04, 18.04 and 20.04 LTS. The Ubuntu snippet lists no fixed packages and no exploitation. On November 13, the Canadian Centre for Cyber Security issued AV26-1159, saying that as of November 11 versions prior to 2.4.71 are affected, without naming CVEs or impact, and urging administrators to apply updates when available.

Key facts
  • CVE-2026-46729 can cause denial of service through incorrect memory handling.
  • Cookie-handling flaw may leak data on Ubuntu 14.04, 16.04, 18.04 and 20.04 LTS.
  • USN-9016-1 covers Ubuntu 14.04 LTS through 26.04 LTS; snippet lists no fixes.
  • CCCS says Apache HTTP Server before 2.4.71 is affected and names no CVEs.
  • Neither notice reports exploitation.
Analyze CVE-2026-46729 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026Ubuntu publishes USN-9016-1 on Apache HTTP Server flaws · Ubuntu Security Notices
  2. Nov 11, 2026CCCS records Apache versions before 2.4.71 as affected · Canadian Centre for Cyber Security
  3. Nov 13, 2026CCCS issues advisory AV26-1159 · Canadian Centre for Cyber Security

What each outlet adds

beyond the shared facts
  • Ubuntu Security NoticesNames CVE-2026-46729, DoS and cookie leak on Ubuntu LTS
  • Canadian Centre for Cyber SecuritySets upstream cutoff at 2.4.71 in advisory AV26-1159
CVEs
CVE-2026-46729
Vendors
Apache
Products
Apache HTTP Server
Organizations
UbuntuCanadian Centre for Cyber Security
Countries
Canada

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Ubuntu Security NoticesFirst report

    Ubuntu warns of Apache HTTP Server DoS and cookie leak

    CVE-2026-46729 affects Ubuntu 14.04 LTS through 26.04 LTS; the snippet states no fixed versions.

  2. · 23h ago Canadian Centre for Cyber Security

    Apache HTTP Server before 2.4.71 affected, Cyber Centre says

    Advisory AV26-1159 names no CVEs or impact and asks administrators to apply updates when available.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-46729
NULL pointer dereference DoS in Apache HTTP Server mod_heartmonitor
7.5—