{"schema_version":"1.7.2","id":"OESA-2026-4366","modified":"2026-10-16T11:59:49Z","published":"2026-10-16T11:59:49Z","upstream":["CVE-2026-42528","CVE-2026-46729","CVE-2026-47360","CVE-2026-56153","CVE-2026-56154","CVE-2026-57941"],"summary":"httpd security update","details":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nA memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue(CVE-2026-42528)\n\nNULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-46729)\n\nExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.\n\n\n\n   \nWhen SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.\n\n\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-47360)\n\nOut-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56153)\n\nUse After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...})\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56154)\n\nUse After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-57941)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"httpd","purl":"pkg:rpm/openEuler/httpd&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-23.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["httpd-2.4.58-23.oe2403sp1.aarch64.rpm","httpd-debuginfo-2.4.58-23.oe2403sp1.aarch64.rpm","httpd-debugsource-2.4.58-23.oe2403sp1.aarch64.rpm","httpd-devel-2.4.58-23.oe2403sp1.aarch64.rpm","httpd-tools-2.4.58-23.oe2403sp1.aarch64.rpm","mod_ldap-2.4.58-23.oe2403sp1.aarch64.rpm","mod_md-2.4.58-23.oe2403sp1.aarch64.rpm","mod_proxy_html-2.4.58-23.oe2403sp1.aarch64.rpm","mod_session-2.4.58-23.oe2403sp1.aarch64.rpm","mod_ssl-2.4.58-23.oe2403sp1.aarch64.rpm"],"noarch":["httpd-filesystem-2.4.58-23.oe2403sp1.noarch.rpm","httpd-help-2.4.58-23.oe2403sp1.noarch.rpm"],"src":["httpd-2.4.58-23.oe2403sp1.src.rpm"],"x86_64":["httpd-2.4.58-23.oe2403sp1.x86_64.rpm","httpd-debuginfo-2.4.58-23.oe2403sp1.x86_64.rpm","httpd-debugsource-2.4.58-23.oe2403sp1.x86_64.rpm","httpd-devel-2.4.58-23.oe2403sp1.x86_64.rpm","httpd-tools-2.4.58-23.oe2403sp1.x86_64.rpm","mod_ldap-2.4.58-23.oe2403sp1.x86_64.rpm","mod_md-2.4.58-23.oe2403sp1.x86_64.rpm","mod_proxy_html-2.4.58-23.oe2403sp1.x86_64.rpm","mod_session-2.4.58-23.oe2403sp1.x86_64.rpm","mod_ssl-2.4.58-23.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4366"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42528"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46729"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47360"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56153"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56154"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57941"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"database_specific":{"severity":"Critical"}}