Executive brief
The Apache HTTP Server, a widely used web server for hosting websites and applications, contains a flaw in how it handles specific website headers and multi-language responses. An attacker could potentially exploit this to cause the web server to crash, leading to a service outage for users. This impact is primarily limited to the availability of the website rather than the theft of sensitive customer data.
Technical details
An out-of-bounds read vulnerability exists in the 'merge_response_headers' function of Apache HTTP Server. The flaw is triggered when the server is configured with both mod_headers and mod_mime and is processing responses involving multiple languages. A remote attacker can exploit this condition to cause a denial of service (child process crash) by sending specially crafted requests that trigger the memory read error. The issue affects versions 2.4.0 through 2.4.67 and is resolved in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-04-27: disclosed: Reported to security team
- 2026-06-05: patched: Fixed in 2.4.x by r1935006
- 2026-06-08: advisory: Update 2.4.68 released and CVE published