Apache httpd -- Multiple vulnerabilities

2026-10-01 · CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768, CVE-2026-93546 · VuXML entry

The Apache httpd project reports: limited RCE for some internal redirects to non-CGI files in CGI directories (CVE-2026-42356) [low] mod_dav shared lock overflow (CVE-2026-42528) [moderate] mod_heartmonitor denial of service (CVE-2026-46729) [low] mod_session: Session cookie not removed during internal redirect (CVE-2026-47360) [low] mod_auth_digest reauthentication attack (CVE-2026-48005) [low] mod_charset_lite: …

Affected versions

• apache24 < 2.4.69

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.