(httpd-site) branch main updated: publishing release httpd-2.4.68
[email protected] Mon, 08 Jun 2026 12:25:19 +0000
| Newsgroups | gmane.comp.apache.cvs |
|---|---|
| Message-ID | <178092151952.2046377.8221666280560556947@gitbox3-he-fi.apache.org> |
This is an automated email from the ASF dual-hosted git repository.
covener pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/httpd-site.git
The following commit(s) were added to refs/heads/main by this push:
new 86c9b87 publishing release httpd-2.4.68
86c9b87 is described below
commit 86c9b87fe03ffba4fadd8060fb1385a59fa09c20
Author: Eric Covener <[email protected]>
AuthorDate: Mon Jun 8 08:25:14 2026 -0400
publishing release httpd-2.4.68
---
content/doap.rdf | 4 +-
content/download.md | 24 ++---
content/index.md | 6 +-
content/security/json/CVE-2026-29167.json | 115 +++++++++++++++++++++
content/security/json/CVE-2026-29170.json | 115 +++++++++++++++++++++
content/security/json/CVE-2026-34355.json | 120 ++++++++++++++++++++++
content/security/json/CVE-2026-34356.json | 120 ++++++++++++++++++++++
content/security/json/CVE-2026-42535.json | 115 +++++++++++++++++++++
content/security/json/CVE-2026-42536.json | 115 +++++++++++++++++++++
content/security/json/CVE-2026-43951.json | 115 +++++++++++++++++++++
content/security/json/CVE-2026-44119.json | 160 ++++++++++++++++++++++++++++++
content/security/json/CVE-2026-44185.json | 115 +++++++++++++++++++++
content/security/json/CVE-2026-44186.json | 115 +++++++++++++++++++++
content/security/json/CVE-2026-44631.json | 120 ++++++++++++++++++++++
content/security/json/CVE-2026-48913.json | 114 +++++++++++++++++++++
content/security/json/CVE-2026-49975.json | 120 ++++++++++++++++++++++
16 files changed, 1576 insertions(+), 17 deletions(-)
diff --git a/content/doap.rdf b/content/doap.rdf
index 1f5a1ab..e844436 100644
--- a/content/doap.rdf
+++ b/content/doap.rdf
@@ -38,8 +38,8 @@
<release>
<Version>
<name>Recommended current 2.4 release</name>
- <created>2026-05-04</created>
- <revision>2.4.67</revision>
+ <created>2026-06-08</created>
+ <revision>2.4.68</revision>
</Version>
</release>
diff --git a/content/download.md b/content/download.md
index af8b421..be56094 100644
--- a/content/download.md
+++ b/content/download.md
@@ -19,13 +19,13 @@ Apache httpd for Microsoft Windows is available from
Stable Release - Latest Version:
-- [2.4.67](#apache24) (released 2026-05-04)
+- [2.4.68](#apache24) (released 2026-06-08)
-# Apache HTTP Server 2.4.67 (httpd): 2.4.67 is the latest available version <span>2026-05-04</span> {#apache24}
+# Apache HTTP Server 2.4.68 (httpd): 2.4.68 is the latest available version <span>2026-06-08</span> {#apache24}
The Apache HTTP Server Project is pleased to
[announce](//downloads.apache.org/httpd/Announcement2.4.txt) the
-release of version 2.4.67 of the Apache HTTP Server ("Apache" and "httpd").
+release of version 2.4.68 of the Apache HTTP Server ("Apache" and "httpd").
This version of Apache is our latest GA release of the new generation 2.4.x
branch of Apache HTTPD and represents fifteen years of innovation by the
project, and is recommended over all previous releases!
@@ -33,17 +33,17 @@ project, and is recommended over all previous releases!
For details, see the [Official
Announcement](//downloads.apache.org/httpd/Announcement2.4.html) and
the [CHANGES_2.4]([preferred]httpd/CHANGES_2.4) and
-[CHANGES_2.4.67]([preferred]httpd/CHANGES_2.4.67) lists.
+[CHANGES_2.4.68]([preferred]httpd/CHANGES_2.4.68) lists.
-- Source: [httpd-2.4.67.tar.bz2]([preferred]httpd/httpd-2.4.67.tar.bz2)
-[ [PGP](https://downloads.apache.org/httpd/httpd-2.4.67.tar.bz2.asc) ] [
-[SHA256](https://downloads.apache.org/httpd/httpd-2.4.67.tar.bz2.sha256) ] [
-[SHA512](https://downloads.apache.org/httpd/httpd-2.4.67.tar.bz2.sha512) ]
+- Source: [httpd-2.4.68.tar.bz2]([preferred]httpd/httpd-2.4.68.tar.bz2)
+[ [PGP](https://downloads.apache.org/httpd/httpd-2.4.68.tar.bz2.asc) ] [
+[SHA256](https://downloads.apache.org/httpd/httpd-2.4.68.tar.bz2.sha256) ] [
+[SHA512](https://downloads.apache.org/httpd/httpd-2.4.68.tar.bz2.sha512) ]
-- Source: [httpd-2.4.67.tar.gz]([preferred]httpd/httpd-2.4.67.tar.gz) [
-[PGP](https://downloads.apache.org/httpd/httpd-2.4.67.tar.gz.asc) ] [
-[SHA256](https://downloads.apache.org/httpd/httpd-2.4.67.tar.gz.sha256) ] [
-[SHA512](https://downloads.apache.org/httpd/httpd-2.4.67.tar.gz.sha512) ]
+- Source: [httpd-2.4.68.tar.gz]([preferred]httpd/httpd-2.4.68.tar.gz) [
+[PGP](https://downloads.apache.org/httpd/httpd-2.4.68.tar.gz.asc) ] [
+[SHA256](https://downloads.apache.org/httpd/httpd-2.4.68.tar.gz.sha256) ] [
+[SHA512](https://downloads.apache.org/httpd/httpd-2.4.68.tar.gz.sha512) ]
- [Security and official patches]([preferred]httpd/patches/)
diff --git a/content/index.md b/content/index.md
index b66f87c..1a5ee10 100644
--- a/content/index.md
+++ b/content/index.md
@@ -15,11 +15,11 @@ mission-critical production infrastructure with:
The Apache HTTP Server is a project of [The Apache Software
Foundation](https://www.apache.org/).
-# Apache httpd 2.4.67 Released <span>2026-05-04</span>
+# Apache httpd 2.4.68 Released <span>2026-06-08</span>
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to
[announce](https://downloads.apache.org/httpd/Announcement2.4.html) the
-release of version 2.4.67 of the Apache HTTP Server ("httpd").
+release of version 2.4.68 of the Apache HTTP Server ("httpd").
This latest release from the 2.4.x stable branch represents the best available
version of Apache HTTP Server.
@@ -28,7 +28,7 @@ version of Apache HTTP Server.
Apache HTTP Server version 2.<span>4</span>.43 or newer is required in order to operate a TLS 1.3 web server with OpenSSL 1.1.1.
[Download](download.cgi#apache24) | [ChangeLog for
-2.4.67](https://downloads.apache.org/httpd/CHANGES_2.4.67) | [Complete ChangeLog for
+2.4.68](https://downloads.apache.org/httpd/CHANGES_2.4.68) | [Complete ChangeLog for
2.4](https://downloads.apache.org/httpd/CHANGES_2.4) | [New Features in httpd
2.4](docs/trunk/new_features_2_4.html) {.centered}
diff --git a/content/security/json/CVE-2026-29167.json b/content/security/json/CVE-2026-29167.json
new file mode 100644
index 0000000..1500354
--- /dev/null
+++ b/content/security/json/CVE-2026-29167.json
@@ -0,0 +1,115 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-29167",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "mod_ldap per-dir use-after-free",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-416: Use After Free",
+ "lang": "en",
+ "cweId": "CWE-416",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration</p><p>This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.</p><p>Users are recommended to upgrade to version 2.4.68, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-03-02T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-03T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1934935"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Pavel Kohout, Aisle Research, Aisle.com",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-29170.json b/content/security/json/CVE-2026-29170.json
new file mode 100644
index 0000000..b810b19
--- /dev/null
+++ b/content/security/json/CVE-2026-29170.json
@@ -0,0 +1,115 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-29170",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "mod_proxy_ftp XSS",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "lang": "en",
+ "cweId": "CWE-79",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.<br><br>Users are recommended to upgrade to version 2.4.68, which fixes this issue."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-03-04T12:15:00.000Z",
+ "lang": "en",
+ "value": "Report received"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-04T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1934982"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Pavel Kohout, Aisle Research, Aisle.com",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-34355.json b/content/security/json/CVE-2026-34355.json
new file mode 100644
index 0000000..49011c0
--- /dev/null
+++ b/content/security/json/CVE-2026-34355.json
@@ -0,0 +1,120 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-34355",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "mod_proxy_html buffer overflow",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-122 Heap-based Buffer Overflow",
+ "lang": "en",
+ "cweId": "CWE-122",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.<br>Users are recommended to upgrade to version 2.4.68, which fixes this issue."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-03-21T09:59:00.000Z",
+ "lang": "en",
+ "value": "Report received"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-04T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1934977"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Elhanan Haenel",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Junhui Lee"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-34356.json b/content/security/json/CVE-2026-34356.json
new file mode 100644
index 0000000..da896ca
--- /dev/null
+++ b/content/security/json/CVE-2026-34356.json
@@ -0,0 +1,120 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-34356",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "ProxyPassReverseCookieMap buffer overflow",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-122 Heap-based Buffer Overflow",
+ "lang": "en",
+ "cweId": "CWE-122",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*</p><p>This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.</p><p>Users are recommended to upgrade to version 2.4.68, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-02-23T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-05T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1935008"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Arkadi Vainbrand",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "depthfirst (depthfirst.com)"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-42535.json b/content/security/json/CVE-2026-42535.json
new file mode 100644
index 0000000..538764d
--- /dev/null
+++ b/content/security/json/CVE-2026-42535.json
@@ -0,0 +1,115 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-42535",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "mod_dav_fs protected directory access",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-668 Exposure of Resource to Wrong Sphere",
+ "lang": "en",
+ "cweId": "CWE-668",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.<br><br>Users are recommended to upgrade to version 2.4.68, which fixes this issue."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-04-27T22:48:00.000Z",
+ "lang": "en",
+ "value": "Report received"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-05T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1935013"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Zhenpeng (Leo) Lin at depthfirst",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-42536.json b/content/security/json/CVE-2026-42536.json
new file mode 100644
index 0000000..54d7d7c
--- /dev/null
+++ b/content/security/json/CVE-2026-42536.json
@@ -0,0 +1,115 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-42536",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "mod_xml2enc heap overflow",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-122 Heap-based Buffer Overflow",
+ "lang": "en",
+ "cweId": "CWE-122",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content</p><p>This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.</p><p>Users are recommended to upgrade to version 2.4.68, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-04-27T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-04T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1934971"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Zhenpeng (Leo) Lin at depthfirst",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-43951.json b/content/security/json/CVE-2026-43951.json
new file mode 100644
index 0000000..2a226c9
--- /dev/null
+++ b/content/security/json/CVE-2026-43951.json
@@ -0,0 +1,115 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-43951",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "OOB Read in `merge_response_headers` can cause crash",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-125 Out-of-bounds Read",
+ "lang": "en",
+ "cweId": "CWE-125",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.</p><p>This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-04-27T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-05T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1935006"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Zhenpeng (Leo) Lin at depthfirst",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-44119.json b/content/security/json/CVE-2026-44119.json
new file mode 100644
index 0000000..ee3286a
--- /dev/null
+++ b/content/security/json/CVE-2026-44119.json
@@ -0,0 +1,160 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-44119",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": "https://httpd.apache.org/",
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "escalation of privilege through expressions in .htaccess in multiple modules",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-269 Improper Privilege Management",
+ "lang": "en",
+ "cweId": "CWE-269",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.\n\nThis issue affects Apache HTTP Server: from through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.</p><p>This issue affects Apache HTTP Server: from through 2.4.67.</p><p>Users are recommended to upgrade to version 2.4.68, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-05-05T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-05T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1935017"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Lucian Nitescu",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "as3617 (@real_as3617) at ENKI Whitehat",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Zhang San",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Martin Petrák",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "joaovicdev",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Rooting | Lucas Torres",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "R4mbb of KRsecurity",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "gggggggga@Xiaomi ShadowBlade Security Lab",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "NikKrian of H3C Security Center(h3c.com)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "lokerxx",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-44185.json b/content/security/json/CVE-2026-44185.json
new file mode 100644
index 0000000..bd5731a
--- /dev/null
+++ b/content/security/json/CVE-2026-44185.json
@@ -0,0 +1,115 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-44185",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Stack Buffer Over-Read in mod_ssl OCSP `send_request`",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-126 Buffer Over-read",
+ "lang": "en",
+ "cweId": "CWE-126",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server</p><p>This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.</p><p>Users are recommended to upgrade to version 2.4.68, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-04-27T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-03T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1934919"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Zhenpeng (Leo) Lin at depthfirst",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-44186.json b/content/security/json/CVE-2026-44186.json
new file mode 100644
index 0000000..49f24d8
--- /dev/null
+++ b/content/security/json/CVE-2026-44186.json
@@ -0,0 +1,115 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-44186",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Loop in `proxy_ftp_handler` in mod_proxy_ftp",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')",
+ "lang": "en",
+ "cweId": "CWE-835",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.\n\nThis issue affects undefined: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.</p><p>This issue affects undefined: from 2.4.0 through 2.4.67.</p><p>Users are recommended to upgrade to version 2.4.68, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-04-27T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-05T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1935004"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Zhenpeng (Leo) Lin at depthfirst",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-44631.json b/content/security/json/CVE-2026-44631.json
new file mode 100644
index 0000000..6ee418c
--- /dev/null
+++ b/content/security/json/CVE-2026-44631.json
@@ -0,0 +1,120 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-44631",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Heap Underflow in `ap_regname` via Signed Char Overflow",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-124: Buffer Underwrite",
+ "lang": "en",
+ "cweId": "CWE-124",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.0",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.</p><p>This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.</p><p>Users are recommended to upgrade to version 2.4.68, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-04-27T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-05T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1935015"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Zhenpeng (Leo) Lin at depthfirst",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Bartlomiej Dmitruk"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
diff --git a/content/security/json/CVE-2026-48913.json b/content/security/json/CVE-2026-48913.json
new file mode 100644
index 0000000..2ba9047
--- /dev/null
+++ b/content/security/json/CVE-2026-48913.json
@@ -0,0 +1,114 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.67",
+ "status": "affected",
+ "version": "2.4.55",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Sam Lovejoy, IBM X-Force Offensive Research (XOR)"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.</p><p>This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.</p><p><br></p>"
+ }
+ ],
+ "value": "Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.67."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-416",
+ "description": "CWE-416 Use After Free",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2026-05-22T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-06-03T12:00:00.000Z",
+ "value": "fixed in 2.4.x by r1934882"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "title": "mod_http2 memory corruption when file handles exhausted",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
+ }
+ ]
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-48913",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1",
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ }
+}
diff --git a/content/security/json/CVE-2026-49975.json b/content/security/json/CVE-2026-49975.json
new file mode 100644
index 0000000..e927180
--- /dev/null
+++ b/content/security/json/CVE-2026-49975.json
@@ -0,0 +1,120 @@
+{
+ "cveMetadata": {
+ "cveId": "CVE-2026-49975",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "CNA_private": {
+ "emailed": null,
+ "projecturl": null,
+ "owner": "httpd",
+ "userslist": "[email protected]",
+ "state": "DRAFT",
+ "todo": [],
+ "type": "unsure"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "mod_http2 denial of service",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-789 Memory Allocation with Excessive Size Value",
+ "lang": "en",
+ "cweId": "CWE-789",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HTTP Server",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.4.17",
+ "lessThanOrEqual": "2.4.67",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\n\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.</p><p>This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.</p><p><br></p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "timeline": [
+ {
+ "time": "2026-05-26T12:00:00.000Z",
+ "lang": "en",
+ "value": "reported"
+ },
+ {
+ "time": "2026-05-27T12:00:00.000Z",
+ "lang": "en",
+ "value": "fixed upstream in mod_h2 https://github.com/icing/mod_h2/commit/35c6e405390ed361189a82acd96675401ea5947c"
+ },
+ {
+ "time": "2026-06-02T12:00:00.000Z",
+ "lang": "en",
+ "value": "fixed in 2.4.x by r1934882"
+ },
+ {
+ "lang": "eng",
+ "time": "2026-06-08T12:00:00.000Z",
+ "value": "2.4.68 released"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Quang Luong of Calif.IO in collaboration with OpenAI Codex",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}