CVE-2026-56154

In mod_proxy_ftp of Apache HTTP Server through 2.4.68, improper validation of the PASV reply address allows an untrusted FTP server, in forward proxy configurations, to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.

In Apache HTTP Server on Windows, processing paths with 8.3 names that may grow when expanded leads to an out-of-bounds write vulnerability. Affects versions from 2.4.0 through 2.4.68.

In mod_dav_fs of Apache HTTP Server before 2.4.69, internal state files are accessible to external parties. A remote client can read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory.

In Apache HTTP Server's mod_proxy_html from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists when processing crafted HTTP response bodies.

In Apache HTTP Server's mod_charset_lite from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists.

In mod_auth_digest of Apache HTTP Server before 2.4.69, missing authentication checks allow an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

NULL Pointer Dereference vulnerability in Apache HTTP Server's mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server from 2.4.0 through 2.4.68.

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server from 2.4.60 through 2.4.68.