Multiple vulnerabilities in Apache HTTP Server

Threats.Kaspersky • October 5, 2026

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information.

Below is a complete list of vulnerabilities:

Security vulnerability can be exploited to bypass security restrictions.

Denial of service vulnerability can be exploited remotely to cause denial of service.

Denial of service vulnerability in finish_partial_char can be exploited remotely to cause denial of service.

A remote code execution vulnerability in mod_rewrite can be exploited remotely to execute arbitrary code.

A remote code execution vulnerability in mod_http2 can be exploited remotely to execute arbitrary code.

Security vulnerability in mod_dav_fs can be exploited to bypass security restrictions.

Denial of service vulnerability in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM can be exploited remotely to cause denial of service.

Information disclosure vulnerability can be exploited to obtain sensitive information.

Fixed in Apache HTTP Server 2.4.69

Public exploits exist for this vulnerability.

CVE-2026-42356 warning

CVE-2026-42528 warning

CVE-2026-46729 critical

CVE-2026-47360 critical

CVE-2026-48005 critical

CVE-2026-56153 critical

CVE-2026-56154 critical

CVE-2026-56449 critical

CVE-2026-57941 critical