CVE-2026-63045
HighCVSS 7.5Summary
In mod_proxy_ftp of Apache HTTP Server through 2.4.68, improper validation of the PASV reply address allows an untrusted FTP server, in forward proxy configurations, to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Risk Assessment
An attacker could use the proxy to scan or attack internal network resources, leading to integrity and confidentiality breaches.
Recommendation
It is recommended to upgrade Apache HTTP Server to version 2.4.69, which fixes this issue.
Other vulnerabilities in Apache HTTP Server
See all- CVE-2026-59685High
In Apache HTTP Server on Windows, processing paths with 8.3 names that may grow when expanded leads to an out-of-bounds write vulnerability. Affects versions from 2.4.0 through 2.4.68.
- CVE-2026-58415Medium
In mod_dav_fs of Apache HTTP Server before 2.4.69, internal state files are accessible to external parties. A remote client can read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory.
- CVE-2026-56449High
In Apache HTTP Server's mod_proxy_html from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists when processing crafted HTTP response bodies.
- CVE-2026-56153High
In Apache HTTP Server's mod_charset_lite from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists.
- CVE-2026-48005High
In mod_auth_digest of Apache HTTP Server before 2.4.69, missing authentication checks allow an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck.
- CVE-2026-47360High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
- CVE-2026-46729High
NULL Pointer Dereference vulnerability in Apache HTTP Server's mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server from 2.4.0 through 2.4.68.
- CVE-2026-42528Medium
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
- CVE-2026-42356Low
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server from 2.4.60 through 2.4.68.
- CVE-2017-9798High
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.
Original NVD description (English source)
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS