Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.
Fix
Microsoft's update · Moderate
- Release Notes — azl3 httpd 2.4.68-1 on Azure Linux 3.0 · build 2.4.69-1
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28.
Patch, vendor advisory and mitigation references on NVD 1
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · apacheNVD modified 2026-10-21 08:16
Affected (CPE criteria) 1
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
References 2
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/01/18 Mailing List, Third Party Advisory