Executive brief
A vulnerability exists in the Apache HTTP Server, a widely used software for hosting websites and web applications. An attacker could exploit this flaw by providing specially crafted content to a server using the mod_xml2enc module, potentially causing the server to crash or allowing for unauthorized code execution. This could lead to service disruptions or a compromise of the server's integrity.
Technical details
A heap-based buffer overflow (CWE-122) exists in the mod_xml2enc module of the Apache HTTP Server. The vulnerability is located within the xml2StartParse function and is triggered when the server processes untrusted content. An attacker can exploit this by sending malicious data that exceeds the allocated buffer space on the heap, potentially leading to a denial-of-service (process crash) or remote code execution. The issue affects versions 2.4.0 through 2.4.67 and is resolved in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-04-27: disclosed: Reported to security team
- 2026-06-04: patched: Fixed in 2.4.x by r1934971
- 2026-06-08: advisory: Update 2.4.68 released