{"id":"USN-8571-2","summary":"apache2 regression","details":"USN-8571-1 fixed vulnerabilities in Apache HTTP Server. That fix was\nincomplete due to a missing library symbol, resulting in a regression\nthat could cause Apache HTTP Server to fail to start when HTTP/2\nproxying was enabled. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server\n incorrectly handled certain memory operations in mod_authn_socache. A\n remote attacker could possibly use this issue to cause a denial of service.\n (CVE-2026-33007)\n\n Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apache\n HTTP Server had an HTTP response splitting vulnerability in multiple\n modules when used with untrusted or compromised backend servers. An\n attacker could possibly use this issue to inject arbitrary HTTP headers.\n (CVE-2026-33523)\n\n Elhanan Haenel discovered that Apache HTTP Server incorrectly handled\n certain memory operations in mod_proxy_ajp. A remote attacker could\n possibly use this issue to cause a denial of service. (CVE-2026-33857)\n\n Tianshuo Han and Jérôme Djouder discovered that Apache HTTP Server\n incorrectly handled certain string operations in mod_proxy_ajp. A remote\n attacker could possibly use this issue to obtain sensitive information.\n (CVE-2026-34032)\n\n It was discovered that Apache HTTP Server's mod_proxy_html module\n incorrectly handled certain content from an untrusted backend. A remote\n attacker could possibly use this issue to cause a denial of service.\n (CVE-2026-34355)\n\n It was discovered that Apache HTTP Server incorrectly handled\n ProxyPassReverseCookie directives with a malicious backend server. A\n remote attacker could possibly use this issue to cause a denial of service.\n (CVE-2026-34356)\n\n It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly\n handled certain path operations. An authenticated user could possibly use\n this issue to manipulate trusted WebDAV property databases or cause a\n denial of service. (CVE-2026-42535)\n\n It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly\n handled certain content from an untrusted backend. A remote attacker could\n possibly use this issue to cause a denial of service. (CVE-2026-42536)\n\n It was discovered that Apache HTTP Server incorrectly handled response\n headers when multiple content languages were configured. A remote\n attacker could possibly use this issue to obtain sensitive information.\n (CVE-2026-43951)\n\n It was discovered that Apache HTTP Server incorrectly restricted certain\n file functions in expressions within .htaccess files. A local attacker\n with .htaccess write access could possibly use this issue to obtain\n sensitive information. (CVE-2026-44119)\n\n It was discovered that Apache HTTP Server's mod_ssl module incorrectly\n handled OCSP responses from an attacker-controlled server. A remote\n attacker could possibly use this issue to obtain sensitive information or\n cause a denial of service. (CVE-2026-44185)\n\n It was discovered that Apache HTTP Server's mod_proxy_ftp module\n incorrectly handled responses from an attacker-controlled backend FTP\n server. A remote attacker could possibly use this issue to cause a denial\n of service. (CVE-2026-44186)\n\n It was discovered that Apache HTTP Server incorrectly handled crafted\n regular expressions in the server configuration. An attacker could\n possibly use this issue to execute arbitrary code or cause a denial of\n service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and\n Ubuntu 20.04 LTS. (CVE-2026-44631)\n\n It was discovered that Apache HTTP Server's mod_http2 module had a\n use-after-free vulnerability when file handles were exhausted. A remote\n attacker could possibly use this issue to cause a denial of service. This\n issue only affected Ubuntu 20.04 LTS. (CVE-2026-48913)","modified":"2026-09-11T09:30:08.415751060Z","published":"2026-09-10T19:36:17Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8571-2"},{"type":"REPORT","url":"https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/2163447"}],"affected":[{"package":{"name":"apache2","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+esm7"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4","2.4.41-4ubuntu3.5","2.4.41-4ubuntu3.6","2.4.41-4ubuntu3.7","2.4.41-4ubuntu3.8","2.4.41-4ubuntu3.9","2.4.41-4ubuntu3.10","2.4.41-4ubuntu3.11","2.4.41-4ubuntu3.12","2.4.41-4ubuntu3.13","2.4.41-4ubuntu3.14","2.4.41-4ubuntu3.15","2.4.41-4ubuntu3.16","2.4.41-4ubuntu3.17","2.4.41-4ubuntu3.19","2.4.41-4ubuntu3.20","2.4.41-4ubuntu3.21","2.4.41-4ubuntu3.23","2.4.41-4ubuntu3.23+esm2","2.4.41-4ubuntu3.23+esm3","2.4.41-4ubuntu3.23+esm4","2.4.41-4ubuntu3.23+esm5","2.4.41-4ubuntu3.23+esm6"],"ecosystem_specific":{"binaries":[{"binary_name":"apache2","binary_version":"2.4.41-4ubuntu3.23+esm7"},{"binary_name":"apache2-bin","binary_version":"2.4.41-4ubuntu3.23+esm7"},{"binary_name":"apache2-data","binary_version":"2.4.41-4ubuntu3.23+esm7"},{"binary_name":"apache2-suexec-custom","binary_version":"2.4.41-4ubuntu3.23+esm7"},{"binary_name":"apache2-suexec-pristine","binary_version":"2.4.41-4ubuntu3.23+esm7"},{"binary_name":"apache2-utils","binary_version":"2.4.41-4ubuntu3.23+esm7"},{"binary_name":"libapache2-mod-md","binary_version":"2.4.41-4ubuntu3.23+esm7"},{"binary_name":"libapache2-mod-proxy-uwsgi","binary_version":"2.4.41-4ubuntu3.23+esm7"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8571-2.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:20.04:LTS"}}}],"schema_version":"1.9.0"}