Skip to main content

Apache HTTP Server CVE-2026-42536

| EUVDEUVD-2026-35100 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-08 apache GHSA-2p7m-6jhq-26cm
Buffer Overflow Apache Heap Overflow Apache Http Server Apache Software Foundation
7.5
CVSS 3.1 · Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Apache 2.4.x with mod_xml2enc enabled
  2. Delivery
    Send HTTP request routing through xml2enc filter
  3. Exploit
    Deliver crafted untrusted XML payload
  4. Execution
    Trigger heap overflow in xml2StartParse
  5. Persist
    Crash httpd worker process
  6. Impact
    Repeat to sustain denial of service

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target Apache HTTP Server (2.4.0-2.4.67) to have the mod_xml2enc module loaded and to process untrusted XML content through the xml2StartParse code path - typically meaning the server is acting as a reverse proxy or output filter for XML/XHTML responses (commonly paired with mod_proxy_html). No authentication and no user interaction are required (PR:N/UI:N), and the attack is delivered over the network (AV:N) at low complexity (AC:L). Deployments that do not load mod_xml2enc, or that only serve static non-XML content without invoking the xml2enc output filter, are not exposed.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated path with availability-only impact - i.e., a remote crash/DoS rather than code execution, despite the heap-overflow primitive class. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so probabilistic exploitation likelihood is unknown. Real-world risk is highest for deployments that actually load mod_xml2enc and proxy or serve XML/XHTML from untrusted upstreams; defenders should treat this as a meaningful availability risk on exposed Apache fleets but below RCE-class urgency. Note that CWE-122 heap overflows can sometimes be escalated beyond DoS, but the CVSS rating from the vendor explicitly scopes impact to availability - defenders should monitor for vendor revisions.
Exploit ScenarioDerived

A remote attacker sends an HTTP request that causes the Apache server to fetch or generate XML content which is then passed through the mod_xml2enc filter; the crafted XML triggers the heap overflow in xml2StartParse and crashes the worker process. Repeating the request causes sustained denial of service against the web service. No public exploit is identified at time of analysis, but the network/low-complexity/no-auth vector lowers the bar for opportunistic abuse once details circulate.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server by submitting untrusted XML content processed by the mod_xml2enc module's xml2StartParse function. The flaw is a CWE-122 heap-based buffer overflow with a CVSS 7.5 score reflecting high availability impact only, and no public exploit has been identified at time of analysis.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.68 - upgrade from any 2.4.0-2.4.67 installation per https://httpd.apache.org/security/vulnerabilities_24.html. If immediate patching is not feasible, an effective compensating control is to unload mod_xml2enc (remove or comment out the LoadModule xml2enc_module directive) since the vulnerable code path lives in that filter; the trade-off is loss of automatic XML/XHTML character-encoding detection, which can cause downstream encoding issues for clients that depend on it. Where mod_xml2enc must remain loaded, restrict its application to trusted upstreams only (avoid proxying XML from untrusted origins through mod_proxy_html chains that invoke xml2enc) and place the server behind a WAF or reverse proxy configured to reject malformed XML, accepting the cost of additional filtering latency.

Affected VersionsENISA

Apache HTTP Server 2.4.0 ≤2.4.67

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache HTTP Server (httpd) is the widely deployed open-source web server maintained by the Apache Software Foundation. The vulnerable component, mod_xml2enc, is a filter module that auto-detects and corrects character encodings for XML/XHTML responses; it leverages libxml2 to parse content. The flaw lives in xml2StartParse where untrusted content is parsed without adequate bounds enforcement, producing a CWE-122 heap-based buffer overflow - corruption of heap-allocated memory adjacent to the parser state. Per the CPE (cpe:2.3:a:apache_software_foundation:apache_http_server), all 2.4.x branches up to and including 2.4.67 are in scope when mod_xml2enc is loaded and handling untrusted XML.

Know when Apache Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 7.5 HIGH

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jun 08, 2026 - 19:22 NVD
7.5 (HIGH)
CVE Published
Jun 08, 2026 - 15:23 nvd
HIGH 7.5
CVE Published
Jun 08, 2026 - 15:23 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Executive ViewAI

Why It Matters

Apache HTTP Server versions 2.4.0 through 2.4.67 contain a denial-of-service vulnerability in the mod_xml2enc module allowing unauthenticated remote attackers to crash the server (no public exploit identified at time of analysis). Organizations with these versions exposed to network traffic face immediate service availability risk and potential customer-facing outages. Urgent remediation planning is required given the absence of available vendor patches.

Business Impact: High
Compensating Controls

Disable or restrict the mod_xml2enc module if XML processing is not operationally required. Implement Web Application Firewall rules to validate and filter untrusted XML input. Apply network segmentation to restrict access to affected Apache instances. Deploy input validation at network edge and rate-limit suspicious requests. Monitor affected systems for unexpected crashes or availability anomalies. These controls reduce risk but do not eliminate exposure pending vendor patch availability.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-93546 HIGH
8.8 Oct 01

An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client

CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-63292 HIGH
7.5 Oct 01

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthen
CVE-2026-59685 HIGH
7.5 Oct 01

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processe
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42536 ADVISORY https://seclists.org/oss-sec/2026/q2/838 ADVISORY https://ubuntu.com/security/notices/USN-8516-1 ADVISORY https://vuldb.com/vuln/369203 REF http://www.openwall.com/lists/oss-security/2026/06/08/9 REF https://access.redhat.com/errata/RHSA-2026:25042 REF https://access.redhat.com/errata/RHSA-2026:34109 REF https://access.redhat.com/errata/RHSA-2026:41906 REF https://access.redhat.com/errata/RHSA-2026:42828 REF https://access.redhat.com/errata/RHSA-2026:47046 REF https://access.redhat.com/errata/RHSA-2026:53371 REF https://access.redhat.com/errata/RHSA-2026:56868 REF https://access.redhat.com/errata/RHSA-2026:56869 REF https://access.redhat.com/errata/RHSA-2026:62165 REF https://access.redhat.com/errata/RHSA-2026:66323 REF https://access.redhat.com/errata/RHSA-2026:67152 REF https://access.redhat.com/security/cve/CVE-2026-42536 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486411 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42536.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy