Executive brief
Apache HTTP Server is a widely used web server for hosting websites and applications. A vulnerability exists where specially crafted regular expressions in the server's configuration files can cause a memory error. This could potentially lead to service instability or crashes, though it requires the ability to modify the server's configuration.
Technical details
A buffer underwrite (CWE-124) vulnerability exists in Apache HTTP Server's 'ap_regname' function due to a signed character overflow. The flaw is triggered by crafted regular expressions within the server configuration. An attacker with the ability to influence the configuration (such as a local user with .htaccess or main config access) could potentially cause a crash or memory corruption. The issue affects versions 2.4.0 through 2.4.67 and is resolved in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-04-27: other: Reported to security team
- 2026-06-05: patched: Fixed in 2.4.x branch
- 2026-06-08: advisory: Public advisory released with version 2.4.68