Skip to main content

Apache HTTP Server CVE-2026-44631

| EUVDEUVD-2026-35095 CRITICAL
Buffer Underwrite ('Buffer Underflow') (CWE-124)
2026-06-08 apache GHSA-9jv8-9586-5r34
Information Disclosure Apache Apache Http Server
9.8
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.8 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.6 MEDIUM

Configuration write access (PR:H) is required to insert the crafted regex; AC:H reflects the non-default configuration dependency despite network-reachable trigger.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Red Hat
7.7 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Severity Changed
Jun 11, 2026 - 04:07 NVD
LOW CRITICAL
CVSS changed
Jun 11, 2026 - 04:07 NVD
9.8 (LOW) 9.8 (CRITICAL)
Severity Changed
Jun 10, 2026 - 18:58 vendor-first correction
CRITICAL LOW
Analysis Generated
Jun 08, 2026 - 21:22 vuln.today
CVSS changed
Jun 08, 2026 - 21:22 NVD
9.8 (CRITICAL)
CVE Published
Jun 08, 2026 - 15:19 nvd
CRITICAL 9.8
CVE Published
Jun 08, 2026 - 15:19 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Articles & Coverage 1

News Apache HTTP Server 2.4.0-2.4.67: buffer underwrite in ap_regname via crafted config regex (CVE-2026-44631) Jun 09, 2026

AnalysisAI

Apache HTTP Server 2.4.0-2.4.67 has a buffer underwrite (CWE-124) in ap_regname, triggered by a crafted regular expression in the server configuration. The vendor (Apache) rates this Low severity. A separate CISA-ADP assessment assigned CVSS 9.8 using a network, unauthenticated vector that is inconsistent with the vendor description, because exploitation requires control over the httpd configuration. No public exploit and not in CISA KEV. Fixed in 2.4.68.

Technical ContextAI

Apache HTTP Server (httpd) is a modular, cross-platform web server maintained by the Apache Software Foundation and identified by CPE cpe:2.3:a:apache_software_foundation:apache_http_server. The root cause is CWE-124 (Buffer Underwrite, a.k.a. 'buffer underflow'), where the program writes to a memory location before the intended buffer start. The trigger is crafted regular expressions processed by httpd's configuration parser - httpd uses PCRE-based regex evaluation in many directives (RewriteRule, LocationMatch, DirectoryMatch, FilesMatch, ProxyPassMatch, etc.), and a malformed pattern can cause the engine to compute a negative offset and write outside the allocated buffer, corrupting adjacent heap or stack memory.

RemediationAI

Vendor-released patch: 2.4.68 - upgrade httpd to 2.4.68 or later from https://httpd.apache.org/ and consult the official advisory at https://httpd.apache.org/security/vulnerabilities_24.html for build-specific notes. Where immediate patching is infeasible, audit httpd configuration (httpd.conf, included vhost files, and any .htaccess files when AllowOverride permits regex directives) to remove untrusted or third-party regular expressions, and on shared-hosting platforms tighten AllowOverride to disallow tenant-supplied regex directives - the trade-off is that legitimate tenant rewrite rules will break, so coordinate with customers. On managed hosting platforms, restrict who can author RewriteRule/LocationMatch/FilesMatch patterns to reduce exposure until 2.4.68 is rolled out.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t
CVE-2026-44185 HIGH
7.3 Jun 08

Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limi
CVE-2026-44186 HIGH
7.3 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from an infinite loop condition in the mod_p
CVE-2026-43951 MEDIUM
6.5 Jun 08

Out-of-bounds read in Apache HTTP Server 2.4.0 through 2.4.67 arises from an interaction between mod_headers, mod_mime,

CVE-2026-29170 MEDIUM
6.1 Jun 08

Cross-site scripting in Apache HTTP Server's mod_proxy_ftp module allows a network-accessible attacker to inject malicio

Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')

View all
CVE-2023-48230 CRITICAL POC
9.8
CVE-2023-32614 CRITICAL POC
9.8
CVE-2023-25610 CRITICAL
9.8
CVE-2021-38575 HIGH POC
8.1
CVE-2022-33896 HIGH POC
7.8
CVE-2025-53101 HIGH POC
7.4
CVE-2025-61915 MEDIUM POC
6.0
CVE-2022-20683 HIGH
8.6

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2024-24919 HIGH POC
8.6

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-44631 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy