(httpd-site) branch main updated: Sync with live, added additional reporter for CVE-2026-34032.
[email protected] Thu, 04 Jun 2026 16:28:13 +0000
| Newsgroups | gmane.comp.apache.cvs |
|---|---|
| Message-ID | <178059049364.1983002.10765641596602841488@gitbox3-he-fi.apache.org> |
This is an automated email from the ASF dual-hosted git repository.
notroj pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/httpd-site.git
The following commit(s) were added to refs/heads/main by this push:
new 538c78c Sync with live, added additional reporter for CVE-2026-34032.
538c78c is described below
commit 538c78cc82fc2fa148a7ca218e6eedc46a8dd4ab
Author: Joe Orton <[email protected]>
AuthorDate: Thu Jun 4 17:27:28 2026 +0100
Sync with live, added additional reporter for CVE-2026-34032.
---
content/security/json/CVE-2026-34032.json | 228 ++++++++++++++++--------------
1 file changed, 125 insertions(+), 103 deletions(-)
diff --git a/content/security/json/CVE-2026-34032.json b/content/security/json/CVE-2026-34032.json
index e6b1d45..9517c74 100644
--- a/content/security/json/CVE-2026-34032.json
+++ b/content/security/json/CVE-2026-34032.json
@@ -1,108 +1,130 @@
{
- "containers": {
- "cna": {
- "affected": [
- {
- "defaultStatus": "unaffected",
- "product": "Apache HTTP Server",
- "vendor": "Apache Software Foundation",
- "versions": [
- {
- "lessThanOrEqual": "2.4.66",
- "status": "affected",
- "version": "0",
- "versionType": "semver"
- }
- ]
- }
- ],
- "credits": [
- {
- "lang": "en",
- "type": "finder",
- "value": "Tianshuo Han (<[email protected]>)"
- },
- {
- "lang": "en",
- "type": "finder",
- "value": "Jérôme Djouder"
- }
- ],
- "descriptions": [
- {
- "lang": "en",
- "supportingMedia": [
- {
- "base64": false,
- "type": "text/html",
- "value": "<p>Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.</p><p>This issue affects Apache HTTP Server: through 2.4.66.</p><p>Users are recommended to upgrade to version 2.4.67, which fixes the issue.</p>"
- }
- ],
- "value": "Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue."
- }
- ],
- "metrics": [
- {
- "other": {
- "content": {
- "text": "low"
+ "cveMetadata": {
+ "cveId": "CVE-2026-34032",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": "yes",
+ "projecturl": "https://httpd.apache.org/",
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "PUBLIC",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
},
- "type": "Textual description of severity"
- }
- }
- ],
- "problemTypes": [
- {
- "descriptions": [
- {
- "cweId": "CWE-170",
- "description": "CWE-170 Improper Null Termination",
- "lang": "en",
- "type": "CWE"
- }
- ]
- },
- {
- "descriptions": [
- {
- "cweId": "CWE-125",
- "description": "CWE-125 Out-of-bounds Read",
- "lang": "en",
- "type": "CWE"
+ "title": "mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-170 Improper Null Termination",
+ "lang": "en",
+ "cweId": "CWE-170",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-125 Out-of-bounds Read",
+ "lang": "en",
+ "cweId": "CWE-125",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "2.4.66",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.\n\nThis issue affects Apache HTTP Server: through 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.67, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.</p><p>This issue affects Apache HTTP Server: through 2.4.66.</p><p>Users are recommended to upgrade to version 2.4.67, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-03-01T02:27:00.000Z",
+ "lang": "en",
+ "value": "Report received"
+ },
+ {
+ "time": "2026-05-04T12:00:00.000Z",
+ "lang": "en",
+ "value": "fixed in 2.4.x by r1933343"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Tianshuo Han (<[email protected]>)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jérôme Djouder",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Sajeeb Lohani working with TrendAI Zero Day Initiative",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
}
- ]
- }
- ],
- "providerMetadata": {
- "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
- },
- "source": {
- "discovery": "UNKNOWN"
- },
- "timeline": [
- {
- "lang": "en",
- "time": "2026-03-01T02:27:00.000Z",
- "value": "Report received"
- },
- {
- "lang": "eng",
- "time": "2026-05-04",
- "value": "2.4.67 released"
}
- ],
- "title": "Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)",
- "x_generator": {
- "engine": "Vulnogram 0.2.0"
- }
- }
- },
- "cveMetadata": {
- "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
- "cveId": "CVE-2026-34032",
- "serial": 1,
- "state": "PUBLISHED"
- },
- "dataType": "CVE_RECORD",
- "dataVersion": "5.1"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
}