Story · 1 source · 8 articlesfirst Oct 1, 18:24 UTCupdated Oct 1, 18:37 UTC (15d ago)

October 2026 Apache HTTP Server and Traffic Server notices

highVulnerabilityimportance 62CVE-2024-38475 CVE-2024-38474 CVE-2024-38476 CVE-2026-49975 CVE-2026-44186 CVE-2026-42535 CVE-2026-63292 CVE-2026-57941

What's new: A later oss-security notice adds moderate Apache Traffic Server CVE-2026-102795, which supersedes CVE-2026-41920 and is fixed in 9.2.15 and 10.1.4. The earlier HTTP Server reports are otherwise unchanged.

Merged summary · grok-4.7 · rewritten as coverage arrives

Unexploited Apache HTTP Server flaws through 2.4.68 were posted in October 2026, with sources split on 2.4.68 or 2.4.69, plus a Traffic Server SNI fix.

On 1 October 2026, oss-security posts described eight Apache HTTP Server vulnerabilities affecting releases through 2.4.68, with no reported exploitation: five moderate and three low. The moderate issues are CVE-2026-42528 in mod_dav, CVE-2026-57941 in mod_http2 with no version range stated, Windows-only CVE-2026-59685 in ap_directory_walk() for 2.4.0 through 2.4.68, CVE-2026-63292 in mod_vhost_alias for the same range when a Host header exceeds 8192 bytes, and CVE-2026-93546 in mod_dav_fs through 2.4.68. The low issues are CVE-2026-42356 in 2.4.60 through 2.4.68, CVE-2026-63718 in 2.4.30 through 2.4.68, and CVE-2026-73636 in 2.4.0 through 2.4.68. Sources disagree on the fix: the CVE-2026-42528 notice both lists affected releases through 2.4.68 and describes the bug in 2.4.67 and earlier, and advises upgrading to 2.4.69, while a 2 October GBHackers article urges 2.4.68 and discusses a different set—CVE-2024-38474, CVE-2024-38475, and CVE-2024-38476 fixed in 2.4.60, plus CVE-2026-49975 fixed in 2.4.68, CVE-2026-44186, and CVE-2026-42535—also with no reported exploitation. Separately, moderate CVE-2026-102795 in Apache Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 fails to enforce SNI-to-Host matching, supersedes CVE-2026-41920, and is fixed in 9.2.15 and 10.1.4, with no exploitation reported.

On 1 October 2026, oss-security described eight unexploited Apache HTTP Server flaws through 2.4.68: moderate CVE-2026-42528, CVE-2026-57941, CVE-2026-59685, CVE-2026-63292, and CVE-2026-93546, and low CVE-2026-42356, CVE-2026-63718, and…
CVE-2026-42528 in mod_dav lets a WebDAV lock creator crash child processes; the notice lists releases through 2.4.68 and also 2.4.67 and earlier, and advises upgrading to 2.4.69.
CVE-2026-59685 is a Windows-only out-of-bounds write in ap_directory_walk() for 2.4.0 through 2.4.68, credited to Dhiraj Mishra and Feng Ning of Innora; CVE-2026-57941 in mod_http2 has no version range stated.
CVE-2026-63292 affects 2.4.0 through 2.4.68 when VirtualDocumentRoot uses a hostname specifier and a Host header exceeds 8192 bytes; CVE-2026-93546 lets an authenticated WebDAV writer crash workers and corrupt property data.
A 2 October GBHackers article instead urges 2.4.68 and cites a different set: CVE-2024-38474, CVE-2024-38475, and CVE-2024-38476 fixed in 2.4.60, plus CVE-2026-49975 (2.4.17 through 2.4.67, fixed in 2.4.68), CVE-2026-44186, and…
Moderate Apache Traffic Server CVE-2026-102795, which supersedes CVE-2026-41920, affects 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 and is fixed in 9.2.15 and 10.1.4; no exploitation is reported.

VendorsApache Software Foundation Apache

ProductsApache HTTP Server mod_vhost_alias mod_http2 mod_dav_fs Apache Traffic Server mod_proxy_uwsgi mod_auth_digest mod_xml2enc

OrganizationsApache Software Foundation Innora Security Research Calif.io Anthropic AISLE

Coverage timelineoldest first · each row is one article

Oct 1, 18:24 UTC · 15d ago
oss-security· 52
CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
Low-severity CVE-2026-42356 can execute some non-CGI files in Apache HTTP Server CGI directories.
Oct 1, 18:26 UTC · 15d ago
oss-security· 46
CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow
Moderate CVE-2026-42528 in Apache mod_dav lets WebDAV lock creators crash httpd child processes.
Oct 1, 18:28 UTC · 15d ago
oss-security· 34
CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service

Vulnerabilities in this storyAll →

CVE-2024-384759.1100%
Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution
published Jul 1, 2024· Apache HTTP Server KEV+2 related
CVE-2026-1027957.0—
Improper Access Control in Apache Traffic Server

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2024-38475 +2 related CVEs CVE-2024-38476 CVE-2024-38474	Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution CVE-2024-38475 is an improper escaping of output flaw (CWE-116) in the mod_rewrite module of the Apache HTTP Server. It is triggered when mod_rewrite maps a request URL to a filesystem location and mishandles encoded characters, allowing a crafted request to reach files that the server is permitted to serve but that were never intentionally or directly reachable by any URL. An attacker can abuse this to disclose source code (for example, serving raw application files) or, depending on the server's configuration and handlers, achieve code execution. Any Apache HTTP Server deployment that uses mod_rewrite is potentially affected; the source data does not specify the vulnerable version range. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, confirming exploitation in the wild, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Inventory Apache HTTP Server deployments, prioritize internet-facing ones, and check whether mod_rewrite is in use (RewriteRule directives in server config, virtual hosts, or .htaccess files); upgrade to the vendor's fixed release, 2.4.60 or later. If immediate upgrade is not possible, follow vendor guidance to harden or constrain mod_rewrite rules, and treat the issue as actively exploited per CISA KEV, applying BOD 22-01 mitigations for cloud service usage or discontinuing use if mitigation is unavailable.	9.1 group max	100%	KEV	Apache HTTP Server Version range not specified in source data; deployments with mod_rewrite enabled prior to the vendor's fixed release (2.4.60 per vendor advisory) are affected	masslikely hundreds of thousands to over a million internet-exposed Apache HTTP Server instances, with only the mod_rewrite-enabled subset vulnerable	Jul 1, 2024 KEV May 1, 2025
CVE-2026-102795	Improper Access Control in Apache Traffic Server Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contain an improper access control flaw (CWE-284). The issue is reachable over the network without authentication or user interaction, though some attack preconditions apply, and the published severity is high (CVSS 4.0 base score 7). Impact is scored against subsequent systems rather than the Traffic Server process itself, with high confidentiality and integrity impact and no availability impact indicated. Operators of Apache Traffic Server in those ranges are affected; this record corrects CVE-2026-41920, which understated the 9.x range and named the wrong fixed 9.x release. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Upgrade Apache Traffic Server to 9.2.15 or 10.1.4. Treat every 9.x release from 9.0.0 through 9.2.14 as vulnerable, including all 9.2.x builds before 9.2.15; do not rely on the narrower range in superseded CVE-2026-41920. After upgrading, confirm the running version and review access-control and proxy rules for unexpected exposure of backend systems.	7.0	—		Apache Software Foundation Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3	moderatethousands to low tens of thousands of deployments	14d ago
CVE-2026-41920	Improper Access Control vulnerability in Apache Traffic Server Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue. NVD description · AI analysis pending	7.0	<1%		apache traffic server	—	Jul 29, 2026
CVE-2026-57941 +9 related CVEs CVE-2026-93546 CVE-2026-73636 CVE-2026-63292 CVE-2026-59685 CVE-2026-63686 CVE-2026-63718 CVE-2026-73637 CVE-2026-42528 CVE-2026-42356	Use-after-free in Apache HTTP Server mod_http2 CVE-2026-57941 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_http2 module, caused by re-entrancy on a shared session->bbtmp buffer that can lead to a wild write. It is triggered through the HTTP/2 handling path when that shared buffer is reused unsafely; the published data does not describe a specific request sequence or confirm remote code execution. An attacker who can exercise the flawed path may corrupt memory in the server process, with impact ranging from a crash to possible further memory corruption, depending on how the freed buffer is reused. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that has mod_http2 loaded is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored. Do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as the Apache project publishes a fix, and confirm the running build is no longer in the 2.4.0–2.4.68 range. Until then, unload mod_http2 if HTTP/2 is not required (check with httpd -M or apachectl -M) and follow the Apache security advisory for this CVE. There is no public proof-of-concept and it is not listed in CISA KEV, but treat internet-facing servers that load mod_http2 as priority.	9.8 group max
CVE-2026-42535 +2 related CVEs CVE-2026-49975 CVE-2026-44186	A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases… A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue. NVD description · AI analysis pending	9.1 group max	<1%		apache http server	—	Jun 8, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2024-38475

+2 related CVEs

CVE-2024-38476 CVE-2024-38474

Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution

CVE-2024-38475 is an improper escaping of output flaw (CWE-116) in the mod_rewrite module of the Apache HTTP Server. It is triggered when mod_rewrite maps a request URL to a filesystem location and mishandles encoded characters, allowing a crafted request to reach files that the server is permitted to serve but that were never intentionally or directly reachable by any URL. An attacker can abuse this to disclose source code (for example, serving raw application files) or, depending on the server's configuration and handlers, achieve code execution. Any Apache HTTP Server deployment that uses mod_rewrite is potentially affected; the source data does not specify the vulnerable version range. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, confirming exploitation in the wild, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Inventory Apache HTTP Server deployments, prioritize internet-facing ones, and check whether mod_rewrite is in use (RewriteRule directives in server config, virtual hosts, or .htaccess files); upgrade to the vendor's fixed release, 2.4.60 or later. If immediate upgrade is not possible, follow vendor guidance to harden or constrain mod_rewrite rules, and treat the issue as actively exploited per CISA KEV, applying BOD 22-01 mitigations for cloud service usage or discontinuing use if mitigation is unavailable.

9.1

group max

100%

KEV

Apache HTTP Server Version range not specified in source data; deployments with mod_rewrite enabled prior to the vendor's fixed release (2.4.60 per vendor advisory) are affected

masslikely hundreds of thousands to over a million internet-exposed Apache HTTP Server instances, with only the mod_rewrite-enabled subset vulnerable

Jul 1, 2024

KEV May 1, 2025

CVE-2026-102795

Improper Access Control in Apache Traffic Server

Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contain an improper access control flaw (CWE-284). The issue is reachable over the network without authentication or user interaction, though some attack preconditions apply, and the published severity is high (CVSS 4.0 base score 7). Impact is scored against subsequent systems rather than the Traffic Server process itself, with high confidentiality and integrity impact and no availability impact indicated. Operators of Apache Traffic Server in those ranges are affected; this record corrects CVE-2026-41920, which understated the 9.x range and named the wrong fixed 9.x release. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade Apache Traffic Server to 9.2.15 or 10.1.4. Treat every 9.x release from 9.0.0 through 9.2.14 as vulnerable, including all 9.2.x builds before 9.2.15; do not rely on the narrower range in superseded CVE-2026-41920. After upgrading, confirm the running version and review access-control and proxy rules for unexpected exposure of backend systems.

7.0

—

Apache Software Foundation Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3

moderatethousands to low tens of thousands of deployments

14d ago

CVE-2026-41920

Improper Access Control vulnerability in Apache Traffic Server

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

NVD description · AI analysis pending

7.0

<1%

apache traffic server

—

Jul 29, 2026

CVE-2026-57941

Use-after-free in Apache HTTP Server mod_http2

CVE-2026-57941 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_http2 module, caused by re-entrancy on a shared session->bbtmp buffer that can lead to a wild write. It is triggered through the HTTP/2 handling path when that shared buffer is reused unsafely; the published data does not describe a specific request sequence or confirm remote code execution. An attacker who can exercise the flawed path may corrupt memory in the server process, with impact ranging from a crash to possible further memory corruption, depending on how the freed buffer is reused. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that has mod_http2 loaded is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.

Do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as the Apache project publishes a fix, and confirm the running build is no longer in the 2.4.0–2.4.68 range. Until then, unload mod_http2 if HTTP/2 is not required (check with httpd -M or apachectl -M) and follow the Apache security advisory for this CVE. There is no public proof-of-concept and it is not listed in CISA KEV, but treat internet-facing servers that load mod_http2 as priority.

9.8

group max

CVE-2026-42535

+2 related CVEs

CVE-2026-49975 CVE-2026-44186

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases…

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

NVD description · AI analysis pending

9.1

group max

<1%

apache http server

—

Jun 8, 2026