Skip to main content

Apache HTTP Server CVE-2026-43951

| EUVDEUVD-2026-35093 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-08 apache GHSA-4qxr-h6g3-8f95
Buffer Overflow Apache Information Disclosure Apache Http Server Apache Software Foundation
6.5
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
Analysis Generated
Jun 08, 2026 - 19:31 vuln.today
CVSS changed
Jun 08, 2026 - 19:22 NVD
6.5 (MEDIUM)
CVE Published
Jun 08, 2026 - 15:16 nvd
MEDIUM 6.5
CVE Published
Jun 08, 2026 - 15:16 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

AnalysisAI

Out-of-bounds read in Apache HTTP Server 2.4.0 through 2.4.67 arises from an interaction between mod_headers, mod_mime, and multi-language content negotiation, allowing unauthenticated remote attackers to trigger memory reads beyond allocated buffer boundaries. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) confirms low-complexity, unauthenticated network exploitation yielding limited confidentiality and integrity impact with no availability consequence. No active exploitation confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-125 (Out-of-bounds Read) describes a class of memory-safety bugs where code reads data past the end of an allocated buffer, potentially leaking adjacent memory contents. In this case, the vulnerability resides in the interaction of two Apache modules - mod_headers (which manipulates HTTP request and response headers) and mod_mime (which determines content type based on file extensions) - when Apache serves responses with multiple language variants via content negotiation (typically enabled via MultiViews or mod_negotiation). The interaction during construction of negotiated, multi-language HTTP responses triggers an unsafe read beyond buffer bounds. Affected product per CPE: cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:*, versions 2.4.0 through 2.4.67 as confirmed by ENISA EUVD-2026-35093. The 'Buffer Overflow' tag in the intelligence data is a loose categorization - the root cause per CWE-125 is specifically an out-of-bounds read, not a write overflow, which typically limits exploitability to information disclosure rather than arbitrary code execution.

RemediationAI

Consult the Apache HTTP Server security advisory at https://httpd.apache.org/security/vulnerabilities_24.html for the confirmed patched release - an exact fix version was not independently confirmed in the available intelligence data, so the advisory should be the authoritative source before upgrading. As compensating controls for deployments that cannot patch immediately: disable mod_headers if custom header manipulation is not required (trade-off: breaks any header rewriting rules in use), disable mod_mime if content-type detection via file extension is unnecessary (trade-off: may affect MIME-type handling for static file serving), or disable MultiViews and mod_negotiation to eliminate multi-language content negotiation entirely (trade-off: breaks language-variant content serving for internationalized sites). Restricting public access to directories configured with MultiViews via IP allowlists is an additional partial mitigation if the feature must remain enabled.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-43951 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy