Anmelden API-Schlüssel holen

Niedrig

CVE-2026-109163Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Apache Software Foundation Apache HTTP Server Veröffentlicht: 2026-11-11 17:55 (vor 13 Stunden)

Beschreibung

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

Schwachstellentyp (CWE): CWE-121

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Apache Software Foundation	Apache HTTP Server	2.4.69 – ≤ 2.4.70

Referenzen und Patches

https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory

Neue CVEs im selben Produkt — Apache HTTP Server

Hoch

CVE-2026-106023 vor 13 Stunden

Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Apache Software Foundation Apache HTTP Server

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Kritisch

CVE-2026-119618 vor 13 Stunden

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Apache Software Foundation Apache HTTP Server

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from …

7.5Hoch

CVE-2026-63686 vor 1 Monat

Apache HTTP Server: mod_xml2enc crash on charset conversion failure

Apache Software Foundation Apache HTTP Server

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…

8.8Hoch

CVE-2026-93546 vor 1 Monat

Apache HTTP Server: mod_dav_fs namespace overflow

Apache Software Foundation Apache HTTP Server

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

5.3Mittel

CVE-2026-79768 vor 1 Monat

Apache HTTP Server: mod_userdir information disclosure

Apache Software Foundation Apache HTTP Server

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue…

7.3Hoch

CVE-2026-73637 vor 1 Monat

Apache HTTP Server: mod_auth_digest DoS attack

Apache Software Foundation Apache HTTP Server

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcC…