USN-9016-1: Apache HTTP Server vulnerabilities

USN-9016-1: Apache HTTP Server vulnerabilities

https://ubuntu.com/security/notices/rss.xml / Tue, 11/10/2026 - 07:52
Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka, Keita Sode and Hyojae Lee discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-46729) It was discovered that Apache HTTP Server did not correctly handle certain session cookies. A remote attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-47360) Zhen Kong discovered that Apache HTTP Server did not correctly handle certain forms of authentication. An unauthenticated remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-48005) Bartlomiej Dmitruk and Masumi Tanaka discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-56153) Lucian Nitescu discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-56449) It was discovered that Apache HTTP Server’s mod_rewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-56154) Lucian Nitescu, Simon Kappel, and Gianluca Danesin discovered that Apache HTTP Server’s mod_http2 module incorrectly handled memory when processing certain HTTP/2 connections. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-57941) Juthawong Naisanguansee, Charles Vosburgh, Mike Read, and Ryoma Nishioka discovered that Apache HTTP Server’s mod_ssl module incorrectly handled certain expressions. An attacker could possibly use this issue to bypass intended access restrictions. This issue only affected Ubuntu 26.10. (CVE-2026-59797) 이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. This issue only affected Ubuntu 26.10. (CVE-2026-63045) Hyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-63292) Lucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not properly handle certain responses from backend servers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-63686) Qing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP responses from backend servers. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks. This issue only affected Ubuntu 26.10. (CVE-2026-63718) Hyojae Lee discovered that Apache HTTP Server did not properly validate Digest authentication requests. A machine-in-the-middle attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 26.10. (CVE-2026-73636) Zhen Kong and Darren Carreras discovered that Apache HTTP Server did not properly manage authentication requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-73637) Vlatko Kosturjak discovered that Apache HTTP Server did not properly enforce access restrictions for user directories. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-79768) Zhen Kong discovered that Apache HTTP Server did not properly handle certain WebDAV requests. An authenticated user could possibly use this issue to cause a denial of service or corrupt WebDAV property data. This issue only affected Ubuntu 26.10. (CVE-2026-93546)

About

Kenya Education Network CERT(KENET-CERT) is a Cybersecurity Emergency Response Team and Co-ordination Center operated by the National Research and Education Network of Kenya. KENET-CERT coordination center promotes awareness on cybersecurity incidences as well as coordinates and assists member institutions in responding effectively to cyber security threats and incidences. KENET-CERT works closely with Kenya's National CIRT coordination center (CIRT/CC) as a sector CIRT for the academic institutions. KENET promotes use of ICT in Teaching, Learning and Research in Higher Education Institutions in Kenya. KENET aims to interconnect all the Universities, Tertiary and Research Institutions in Kenya by setting up a cost effective and sustainable private network with high speed access to the global Internet. KENET also facilitates electronic communication among students and faculties in member institutions, share learning and teaching resources by collaboration in Research and Development of Educational content.