{"schema_version":"1.7.2","id":"OESA-2026-2745","modified":"2026-08-06T11:11:40Z","published":"2026-06-24T11:11:40Z","upstream":["CVE-2026-29167","CVE-2026-29170","CVE-2026-34355","CVE-2026-34356","CVE-2026-42535","CVE-2026-42536","CVE-2026-44119","CVE-2026-44186","CVE-2026-44631"],"summary":"httpd security update","details":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nUse After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-29167)\n\nA cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-29170)\n\nA buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-34355)\n\nHeap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)\n\nA path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)\n\nHeap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-42536)\n\nImproper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.\n\nThis issue affects Apache HTTP Server: from through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44119)\n\nLoop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.\n\nThis issue affects undefined: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)\n\nBuffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"httpd","purl":"pkg:rpm/openEuler/httpd&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-33.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["httpd-2.4.51-33.oe2203sp4.aarch64.rpm","httpd-debuginfo-2.4.51-33.oe2203sp4.aarch64.rpm","httpd-debugsource-2.4.51-33.oe2203sp4.aarch64.rpm","httpd-devel-2.4.51-33.oe2203sp4.aarch64.rpm","httpd-tools-2.4.51-33.oe2203sp4.aarch64.rpm","mod_ldap-2.4.51-33.oe2203sp4.aarch64.rpm","mod_md-2.4.51-33.oe2203sp4.aarch64.rpm","mod_proxy_html-2.4.51-33.oe2203sp4.aarch64.rpm","mod_session-2.4.51-33.oe2203sp4.aarch64.rpm","mod_ssl-2.4.51-33.oe2203sp4.aarch64.rpm"],"noarch":["httpd-filesystem-2.4.51-33.oe2203sp4.noarch.rpm","httpd-help-2.4.51-33.oe2203sp4.noarch.rpm"],"src":["httpd-2.4.51-33.oe2203sp4.src.rpm"],"x86_64":["httpd-2.4.51-33.oe2203sp4.x86_64.rpm","httpd-debuginfo-2.4.51-33.oe2203sp4.x86_64.rpm","httpd-debugsource-2.4.51-33.oe2203sp4.x86_64.rpm","httpd-devel-2.4.51-33.oe2203sp4.x86_64.rpm","httpd-tools-2.4.51-33.oe2203sp4.x86_64.rpm","mod_ldap-2.4.51-33.oe2203sp4.x86_64.rpm","mod_md-2.4.51-33.oe2203sp4.x86_64.rpm","mod_proxy_html-2.4.51-33.oe2203sp4.x86_64.rpm","mod_session-2.4.51-33.oe2203sp4.x86_64.rpm","mod_ssl-2.4.51-33.oe2203sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2745"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29167"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29170"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34355"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34356"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42535"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42536"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44119"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44186"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44631"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"database_specific":{"severity":"Critical"}}