Apache HTTP Server CVE-2026-59685

Exploitation is limited to Apache HTTP Server running on Windows (non-Windows builds are unaffected) and requires the server to process paths containing MS-DOS 8.3 short filenames that grow when expanded - which in turn depends on 8.3 short-name generation being enabled on the underlying NTFS volume (the historical default unless NtfsDisable8dot3NameCreation has been set). The attacker must be able to supply or cause resolution of such a path. Limiting factors: Windows-only deployment, dependence on 8.3 name creation being enabled, and the need for the expanding-path code path to be reached; authentication requirements are not confirmed from available data because no CVSS vector was provided.

Signals are sparse for this CVE: the vendor (Apache) provides NO CVSS score or vector, and there is no EPSS probability, no CISA KEV listing, and no public POC in the supplied intelligence, so no SSVC-style automatable/exploitation inputs are confirmed. Risk must therefore be reasoned from the description and CWE-787 (out-of-bounds write) alone, which makes any quantitative risk statement inherently uncertain - this is a memory-corruption flaw whose real-world severity (crash versus potential code execution) cannot be confirmed from available data. Two important constraints temper the raw danger of an OOB write in a ubiquitous web server: it is Windows-only, and it hinges on processing paths with 8.3 short names that expand, which depends on 8.3 short-name generation being enabled on the serving volume. Net assessment: this is a plausibly serious but currently unproven-in-the-wild issue affecting only the Windows subset of Apache deployments; treat it as patch-worthy (very broad version range 2.4.0-2.4.68) but not as a confirmed active-exploitation emergency, because EPSS, KEV, POC, and even a CVSS vector are all missing and must be verified with Apache's advisory.

An attacker sends an Apache HTTP Server instance on Windows a request whose path resolves through an 8.3 short filename that expands to a longer string during processing, overflowing a buffer and triggering an out-of-bounds write. Depending on how the corruption lands this could crash the worker (denial of service) or potentially be steered toward code execution. No public exploit code was identified in the supplied data, so feasibility of reliable RCE is unconfirmed.