{"id":"SUSE-SU-2026:5075-1","summary":"Security update for apache2","details":"This update for apache2 fixes the following issues:\n\n- CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated\n  as CGI and executed (bsc#1284043).\n- CVE-2026-42528: memory calculation bug in `mod_dav` allows an attacker with permission to create WebDAV locks to crash\n  server child processes (bsc#1284044).\n- CVE-2026-46729: NULL pointer dereference in `mod_heartmonitor` over unicast listener (bsc#1284045).\n- CVE-2026-47360: session cookie passed to a backend server when `SessionCookieRemove` changes across internal redirects\n  (bsc#1284046).\n- CVE-2026-48005: missing authentication checks in `mod_auth_digest` allows an unauthenticated remote client to cause a\n  DoS via forged `Authorization` headers when Digest authentication is enabled with `AuthDigestNcCheck` (bsc#1284047).\n- CVE-2026-56153: out-of-bounds write in `mod_charset_lite` (bsc#1284048).\n- CVE-2026-56154: use-after-free in `mod_rewrite` when using lookahead `(%{LA-U:HTTP:...})` (bsc#1284049).\n- CVE-2026-57941: use-after-free in `mod_http2` via shared `session-\u003ebbtmp` re-entrancy (bsc#1284050).\n- CVE-2026-58415: internal state files accessible to external parties in `mod_dav_fs` allows a remote client to read\n  WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory (bsc#1284051).\n- CVE-2026-59797: improper privilege management in `mod_ssl` when using `SSLRequire` and file-related expressions\n  (bsc#1284059).\n- CVE-2026-63045: improper validation of FTP PASV reply address in `mod_proxy_ftp` allows an untrusted FTP server to\n  cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060).\n- CVE-2026-63292: stack-based buffer overflow in `mod_vhost_alias` allows a remote client to cause a DoS or potentially\n  execute arbitrary code via an HTTP request with a specially crafted `Host` header (bsc#1284061).\n- CVE-2026-63686: NULL pointer dereference in `mod_xml2enc` allows an untrusted backend server to cause a denial of\n  service via a crafted proxied response (bsc#1284058).\n- CVE-2026-63718: inconsistent interpretation of HTTP requests in `mod_proxy_uwsgi` allows for response smuggling via a\n  crafted uwsgi response with `Transfer-Encoding` (bsc#1284057).\n- CVE-2026-73636: authentication bypass by capture-replay in `mod_auth_digest` allows a MiTM attacker to replay captured\n  digest authentication credentials via crafted requests (bsc#1284056).\n- CVE-2026-73637: use-after-free in `mod_auth_digest` allows an unauthenticated remote client to cause authentication\n  state corruption via concurrent Digest authentication requests (bsc#1284055).\n- CVE-2026-79768: path equivalence issue in the `mod_userdir` module when configured with absolute non-wildcard\n  `UserDir` directive (bsc#1284054).\n- CVE-2026-93546: integer overflow in `mod_dav_fs` allows an authenticated WebDAV client with write access to crash\n  worker processes and persistently corrupt a directory's property database (bsc#1284053).\n","modified":"2026-11-03T22:45:05.208191445Z","published":"2026-11-03T08:18:31Z","related":["CVE-2026-42356","CVE-2026-42528","CVE-2026-46729","CVE-2026-47360","CVE-2026-48005","CVE-2026-56153","CVE-2026-56154","CVE-2026-57941","CVE-2026-58415","CVE-2026-59797","CVE-2026-63045","CVE-2026-63292","CVE-2026-63686","CVE-2026-63718","CVE-2026-73636","CVE-2026-73637","CVE-2026-79768","CVE-2026-93546"],"upstream":["CVE-2026-42356","CVE-2026-42528","CVE-2026-46729","CVE-2026-47360","CVE-2026-48005","CVE-2026-56153","CVE-2026-56154","CVE-2026-57941","CVE-2026-58415","CVE-2026-59797","CVE-2026-63045","CVE-2026-63292","CVE-2026-63686","CVE-2026-63718","CVE-2026-73636","CVE-2026-73637","CVE-2026-79768","CVE-2026-93546"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265075-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284043"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284044"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284045"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284046"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284047"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284048"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284049"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284050"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284051"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284053"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284054"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284055"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284056"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284057"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284058"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284059"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284060"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284061"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42356"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42528"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46729"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47360"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48005"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56153"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56154"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-57941"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-58415"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59797"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63045"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63292"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63686"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63718"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-73636"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-73637"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-79768"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93546"}],"affected":[{"package":{"name":"apache2","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-devel","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-manual","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-prefork","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-utils","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-worker","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-devel","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-manual","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-prefork","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-utils","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-devel":"2.4.66-150600.5.58.1","apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}},{"package":{"name":"apache2-worker","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-150600.5.58.1"}]}],"ecosystem_specific":{"binaries":[{"apache2-manual":"2.4.66-150600.5.58.1","apache2-prefork":"2.4.66-150600.5.58.1","apache2-utils":"2.4.66-150600.5.58.1","apache2-worker":"2.4.66-150600.5.58.1","apache2":"2.4.66-150600.5.58.1","apache2-devel":"2.4.66-150600.5.58.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5075-1.json"}}],"schema_version":"1.9.2"}