An update for httpd is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4465 Final 1.0 1.0 2026-10-22 Initial 2026-10-22 2026-10-22 openEuler SA Tool V1.0 2026-10-22 httpd security update An update for httpd is now available for openEuler-24.03-LTS-SP3 Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56153) Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56154) Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-57941) Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-58415) Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-59685) Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-59797) Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-63045) Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-63292) A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-63686) Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.(CVE-2026-63718) Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-79768) Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.(CVE-2026-93546) An update for httpd is now available for openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical httpd https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56153 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56154 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-57941 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58415 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59685 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59797 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63045 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63292 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63686 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63718 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-79768 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-93546 https://nvd.nist.gov/vuln/detail/CVE-2026-56153 https://nvd.nist.gov/vuln/detail/CVE-2026-56154 https://nvd.nist.gov/vuln/detail/CVE-2026-57941 https://nvd.nist.gov/vuln/detail/CVE-2026-58415 https://nvd.nist.gov/vuln/detail/CVE-2026-59685 https://nvd.nist.gov/vuln/detail/CVE-2026-59797 https://nvd.nist.gov/vuln/detail/CVE-2026-63045 https://nvd.nist.gov/vuln/detail/CVE-2026-63292 https://nvd.nist.gov/vuln/detail/CVE-2026-63686 https://nvd.nist.gov/vuln/detail/CVE-2026-63718 https://nvd.nist.gov/vuln/detail/CVE-2026-79768 https://nvd.nist.gov/vuln/detail/CVE-2026-93546 openEuler-24.03-LTS-SP3 httpd-2.4.58-24.oe2403sp3.aarch64.rpm httpd-debuginfo-2.4.58-24.oe2403sp3.aarch64.rpm httpd-debugsource-2.4.58-24.oe2403sp3.aarch64.rpm httpd-devel-2.4.58-24.oe2403sp3.aarch64.rpm httpd-tools-2.4.58-24.oe2403sp3.aarch64.rpm mod_ldap-2.4.58-24.oe2403sp3.aarch64.rpm mod_md-2.4.58-24.oe2403sp3.aarch64.rpm mod_proxy_html-2.4.58-24.oe2403sp3.aarch64.rpm mod_session-2.4.58-24.oe2403sp3.aarch64.rpm mod_ssl-2.4.58-24.oe2403sp3.aarch64.rpm httpd-2.4.58-24.oe2403sp3.src.rpm httpd-2.4.58-24.oe2403sp3.x86_64.rpm httpd-debuginfo-2.4.58-24.oe2403sp3.x86_64.rpm httpd-debugsource-2.4.58-24.oe2403sp3.x86_64.rpm httpd-devel-2.4.58-24.oe2403sp3.x86_64.rpm httpd-tools-2.4.58-24.oe2403sp3.x86_64.rpm mod_ldap-2.4.58-24.oe2403sp3.x86_64.rpm mod_md-2.4.58-24.oe2403sp3.x86_64.rpm mod_proxy_html-2.4.58-24.oe2403sp3.x86_64.rpm mod_session-2.4.58-24.oe2403sp3.x86_64.rpm mod_ssl-2.4.58-24.oe2403sp3.x86_64.rpm httpd-filesystem-2.4.58-24.oe2403sp3.noarch.rpm httpd-help-2.4.58-24.oe2403sp3.noarch.rpm Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-22 CVE-2026-56153 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-22 CVE-2026-56154 openEuler-24.03-LTS-SP3 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-22 CVE-2026-57941 openEuler-24.03-LTS-SP3 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-22 CVE-2026-58415 openEuler-24.03-LTS-SP3 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-22 CVE-2026-59685 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-22 CVE-2026-59797 openEuler-24.03-LTS-SP3 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue. 2026-10-22 CVE-2026-63045 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue. 2026-10-22 CVE-2026-63292 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue. 2026-10-22 CVE-2026-63686 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68. 2026-10-22 CVE-2026-63718 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-22 CVE-2026-79768 openEuler-24.03-LTS-SP3 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces. 2026-10-22 CVE-2026-93546 openEuler-24.03-LTS-SP3 High 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H httpd security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4465