CVE-2026-42356

Vendor

Apache Software Foundation

Product

Apache HTTP Server

CVSS

3.7

EPSS

0.003 (p23)

Exposure class

Web platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 46
   Ubuntu notice Ubuntu 4h ago

   Apache HTTP Server vulnerabilities

   Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache…

   CVE-2026-42528CVE-2026-109163CVE-2026-106023+2 more Canonical Apache Software Foundation
2. 5
   CVE NVD 1 Oct 2026

   Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as…

   Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and…

   CVSS 3.7 CVE-2026-42356 Apache Software Foundation