An update for httpd is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4366 Final 1.0 1.0 2026-10-16 Initial 2026-10-16 2026-10-16 openEuler SA Tool V1.0 2026-10-16 httpd security update An update for httpd is now available for openEuler-24.03-LTS-SP1 Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue(CVE-2026-42528) NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-46729) Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-47360) Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56153) Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56154) Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-57941) An update for httpd is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical httpd https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-42528 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-46729 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-47360 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56153 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56154 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-57941 https://nvd.nist.gov/vuln/detail/CVE-2026-42528 https://nvd.nist.gov/vuln/detail/CVE-2026-46729 https://nvd.nist.gov/vuln/detail/CVE-2026-47360 https://nvd.nist.gov/vuln/detail/CVE-2026-56153 https://nvd.nist.gov/vuln/detail/CVE-2026-56154 https://nvd.nist.gov/vuln/detail/CVE-2026-57941 openEuler-24.03-LTS-SP1 httpd-2.4.58-23.oe2403sp1.aarch64.rpm httpd-debuginfo-2.4.58-23.oe2403sp1.aarch64.rpm httpd-debugsource-2.4.58-23.oe2403sp1.aarch64.rpm httpd-devel-2.4.58-23.oe2403sp1.aarch64.rpm httpd-tools-2.4.58-23.oe2403sp1.aarch64.rpm mod_ldap-2.4.58-23.oe2403sp1.aarch64.rpm mod_md-2.4.58-23.oe2403sp1.aarch64.rpm mod_proxy_html-2.4.58-23.oe2403sp1.aarch64.rpm mod_session-2.4.58-23.oe2403sp1.aarch64.rpm mod_ssl-2.4.58-23.oe2403sp1.aarch64.rpm httpd-2.4.58-23.oe2403sp1.src.rpm httpd-2.4.58-23.oe2403sp1.x86_64.rpm httpd-debuginfo-2.4.58-23.oe2403sp1.x86_64.rpm httpd-debugsource-2.4.58-23.oe2403sp1.x86_64.rpm httpd-devel-2.4.58-23.oe2403sp1.x86_64.rpm httpd-tools-2.4.58-23.oe2403sp1.x86_64.rpm mod_ldap-2.4.58-23.oe2403sp1.x86_64.rpm mod_md-2.4.58-23.oe2403sp1.x86_64.rpm mod_proxy_html-2.4.58-23.oe2403sp1.x86_64.rpm mod_session-2.4.58-23.oe2403sp1.x86_64.rpm mod_ssl-2.4.58-23.oe2403sp1.x86_64.rpm httpd-filesystem-2.4.58-23.oe2403sp1.noarch.rpm httpd-help-2.4.58-23.oe2403sp1.noarch.rpm A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue 2026-10-16 CVE-2026-42528 openEuler-24.03-LTS-SP1 Medium 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L httpd security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366 NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-16 CVE-2026-46729 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H httpd security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-16 CVE-2026-47360 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N httpd security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-16 CVE-2026-56153 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N httpd security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-16 CVE-2026-56154 openEuler-24.03-LTS-SP1 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H httpd security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. 2026-10-16 CVE-2026-57941 openEuler-24.03-LTS-SP1 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H httpd security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366