CVE-2026-42356
LowCVSS 3.7Summary
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server from 2.4.60 through 2.4.68.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized CGI code, potentially leading to server integrity compromise, data leakage, or system takeover. The organization is exposed to severe security impacts, including access to sensitive resources.
Recommendation
Upgrade Apache HTTP Server to a version newer than 2.4.68 that includes the fix. Additionally, review CGI directory configurations and ensure no unnecessary executable files are present in locations accessible to redirects.
Other vulnerabilities in Apache HTTP Server
See all- CVE-2026-63045High
In mod_proxy_ftp of Apache HTTP Server through 2.4.68, improper validation of the PASV reply address allows an untrusted FTP server, in forward proxy configurations, to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
- CVE-2026-59685High
In Apache HTTP Server on Windows, processing paths with 8.3 names that may grow when expanded leads to an out-of-bounds write vulnerability. Affects versions from 2.4.0 through 2.4.68.
- CVE-2026-58415Medium
In mod_dav_fs of Apache HTTP Server before 2.4.69, internal state files are accessible to external parties. A remote client can read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory.
- CVE-2026-56449High
In Apache HTTP Server's mod_proxy_html from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists when processing crafted HTTP response bodies.
- CVE-2026-56153High
In Apache HTTP Server's mod_charset_lite from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists.
- CVE-2026-48005High
In mod_auth_digest of Apache HTTP Server before 2.4.69, missing authentication checks allow an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck.
- CVE-2026-47360High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
- CVE-2026-46729High
NULL Pointer Dereference vulnerability in Apache HTTP Server's mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server from 2.4.0 through 2.4.68.
- CVE-2026-42528Medium
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
- CVE-2017-9798High
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.
Original NVD description (English source)
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS