Apache HTTP Server vulnerabilities
Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42528) It was discovered that Apache HTTP Server's mod_vhost_alias module incorrectly handled certain requests, leading to a one-byte stack buffer overflow. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-109163) It was discovered that Apache HTTP Server's mod_md module incorrectly handled
Read at Ubuntu Security Notices
- Vendor
- Canonical, Apache Software Foundation
- Product
- Apache HTTP Server
- EPSS
- 0.003 (p23)
- Exposure class
- Web platform
Why it ranks 46 (High)
- Product class: web platform
- Widely deployed vendor product (Canonical)
- Covered by 5 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Ubuntu Security Notices (ubuntu.com)
- CVE-2026-42528 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109163 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-106023 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-119618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-42356 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.