{"id":"USN-9016-1","summary":"apache2 vulnerabilities","details":"Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka,\nKeita Sode and Hyojae Lee discovered that Apache HTTP Server did not\ncorrectly handle certain memory operations. An attacker could possibly\nuse this issue to cause a denial of service. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-46729)\n\nIt was discovered that Apache HTTP Server did not correctly handle\ncertain session cookies. A remote attacker could possibly use this issue\nto leak sensitive information. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-47360)\n\nZhen Kong discovered that Apache HTTP Server did not correctly handle\ncertain forms of authentication. An unauthenticated remote attacker\ncould possibly use this issue to cause a denial of service. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 26.04 LTS. (CVE-2026-48005)\n\nBartlomiej Dmitruk and Masumi Tanaka discovered that Apache HTTP Server\ndid not correctly handle certain memory operations. An attacker could\npossibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2026-56153)\n\nLucian Nitescu discovered that Apache HTTP Server did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,\nUbuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-56449)\n\nIt was discovered that Apache HTTP Server’s mod_rewrite module incorrectly\nhandled memory when performing certain variable lookups. A remote attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-56154)\n\nLucian Nitescu, Simon Kappel, and Gianluca Danesin discovered that Apache\nHTTP Server’s mod_http2 module incorrectly handled memory when processing\ncertain HTTP/2 connections. A remote attacker could possibly use this issue\nto cause a denial of service or execute arbitrary code. This issue only\naffected Ubuntu 26.10. (CVE-2026-57941)\n\nJuthawong Naisanguansee, Charles Vosburgh, Mike Read, and Ryoma Nishioka\ndiscovered that Apache HTTP Server’s mod_ssl module incorrectly handled\ncertain expressions. An attacker could possibly use this issue to bypass\nintended access restrictions. This issue only affected Ubuntu 26.10.\n(CVE-2026-59797)\n\n이지웅 discovered that Apache HTTP Server exposed WebDAV property information.\nA remote attacker could possibly use this issue to obtain sensitive\ninformation. This issue only affected Ubuntu 26.10. (CVE-2026-58415)\n\nZhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not\nproperly validate FTP server responses. A remote attacker could possibly\nuse this issue to make a forward proxy connect to an arbitrary host.\nThis issue only affected Ubuntu 26.10. (CVE-2026-63045)\n\nHyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly\nhandled certain HTTP requests. A remote attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 26.10. (CVE-2026-63292)\n\nLucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not\nproperly handle certain responses from backend servers. A remote attacker\ncould possibly use this issue to cause a denial of service. This issue\nonly affected Ubuntu 26.10. (CVE-2026-63686)\n\nQing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP\nresponses from backend servers. A remote attacker could possibly use this\nissue to perform HTTP response smuggling attacks. This issue only affected\nUbuntu 26.10. (CVE-2026-63718)\n\nHyojae Lee discovered that Apache HTTP Server did not properly validate\nDigest authentication requests. A machine-in-the-middle attacker could\npossibly use this issue to bypass authentication. This issue only\naffected Ubuntu 26.10. (CVE-2026-73636)\n\nZhen Kong and Darren Carreras discovered that Apache HTTP Server did not\nproperly manage authentication requests. A remote attacker could possibly\nuse this issue to cause a denial of service. This issue only affected\nUbuntu 26.10. (CVE-2026-73637)\n\nVlatko Kosturjak discovered that Apache HTTP Server did not properly\nenforce access restrictions for user directories. A remote attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 26.10. (CVE-2026-79768)\n\nZhen Kong discovered that Apache HTTP Server did not properly handle\ncertain WebDAV requests. An authenticated user could possibly use this\nissue to cause a denial of service or corrupt WebDAV property data. This\nissue only affected Ubuntu 26.10. (CVE-2026-93546)","modified":"2026-11-11T09:43:44.265929475Z","published":"2026-11-10T02:43:47Z","related":["UBUNTU-CVE-2026-46729","UBUNTU-CVE-2026-47360","UBUNTU-CVE-2026-48005","UBUNTU-CVE-2026-56153","UBUNTU-CVE-2026-56154","UBUNTU-CVE-2026-56449","UBUNTU-CVE-2026-57941","UBUNTU-CVE-2026-58415","UBUNTU-CVE-2026-59797","UBUNTU-CVE-2026-63045","UBUNTU-CVE-2026-63292","UBUNTU-CVE-2026-63686","UBUNTU-CVE-2026-63718","UBUNTU-CVE-2026-73636","UBUNTU-CVE-2026-73637","UBUNTU-CVE-2026-79768","UBUNTU-CVE-2026-93546"],"upstream":["CVE-2026-46729","CVE-2026-47360","CVE-2026-48005","CVE-2026-56153","CVE-2026-56154","CVE-2026-56449","CVE-2026-57941","CVE-2026-58415","CVE-2026-59797","CVE-2026-63045","CVE-2026-63292","CVE-2026-63686","CVE-2026-63718","CVE-2026-73636","CVE-2026-73637","CVE-2026-79768","CVE-2026-93546","UBUNTU-CVE-2026-46729","UBUNTU-CVE-2026-47360","UBUNTU-CVE-2026-48005","UBUNTU-CVE-2026-56153","UBUNTU-CVE-2026-56154","UBUNTU-CVE-2026-56449","UBUNTU-CVE-2026-57941","UBUNTU-CVE-2026-58415","UBUNTU-CVE-2026-59797","UBUNTU-CVE-2026-63045","UBUNTU-CVE-2026-63292","UBUNTU-CVE-2026-63686","UBUNTU-CVE-2026-63718","UBUNTU-CVE-2026-73636","UBUNTU-CVE-2026-73637","UBUNTU-CVE-2026-79768","UBUNTU-CVE-2026-93546"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-9016-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-46729"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-47360"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-48005"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-56153"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-56154"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-56449"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-57941"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-58415"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-59797"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-63045"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-63292"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-63686"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-63718"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-73636"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-73637"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-79768"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-93546"}],"affected":[{"package":{"name":"apache2","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra-legacy%2Ftrusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.22+esm18"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4","2.4.7-1ubuntu4.1","2.4.7-1ubuntu4.4","2.4.7-1ubuntu4.5","2.4.7-1ubuntu4.6","2.4.7-1ubuntu4.7","2.4.7-1ubuntu4.8","2.4.7-1ubuntu4.9","2.4.7-1ubuntu4.10","2.4.7-1ubuntu4.11","2.4.7-1ubuntu4.13","2.4.7-1ubuntu4.15","2.4.7-1ubuntu4.16","2.4.7-1ubuntu4.17","2.4.7-1ubuntu4.18","2.4.7-1ubuntu4.19","2.4.7-1ubuntu4.20","2.4.7-1ubuntu4.21","2.4.7-1ubuntu4.22","2.4.7-1ubuntu4.22+esm1","2.4.7-1ubuntu4.22+esm2","2.4.7-1ubuntu4.22+esm3","2.4.7-1ubuntu4.22+esm4","2.4.7-1ubuntu4.22+esm5","2.4.7-1ubuntu4.22+esm6","2.4.7-1ubuntu4.22+esm8","2.4.7-1ubuntu4.22+esm9","2.4.7-1ubuntu4.22+esm10","2.4.7-1ubuntu4.22+esm12","2.4.7-1ubuntu4.22+esm13","2.4.7-1ubuntu4.22+esm14","2.4.7-1ubuntu4.22+esm15","2.4.7-1ubuntu4.22+esm16","2.4.7-1ubuntu4.22+esm17"],"ecosystem_specific":{"binaries":[{"binary_version":"2.4.7-1ubuntu4.22+esm18","binary_name":"apache2"},{"binary_name":"apache2-bin","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_version":"2.4.7-1ubuntu4.22+esm18","binary_name":"apache2-data"},{"binary_name":"apache2-mpm-event","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_name":"apache2-mpm-itk","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_name":"apache2-mpm-prefork","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_name":"apache2-mpm-worker","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_version":"2.4.7-1ubuntu4.22+esm18","binary_name":"apache2-suexec"},{"binary_name":"apache2-suexec-custom","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_name":"apache2-suexec-pristine","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_name":"apache2-utils","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_name":"apache2.2-bin","binary_version":"2.4.7-1ubuntu4.22+esm18"},{"binary_version":"1:2.4.7-1ubuntu4.22+esm18","binary_name":"libapache2-mod-macro"},{"binary_name":"libapache2-mod-proxy-html","binary_version":"1:2.4.7-1ubuntu4.22+esm18"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:14.04:LTS","cves":[{"id":"CVE-2026-46729","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-47360","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-48005"},{"id":"CVE-2026-56153","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"score":"medium","type":"Ubuntu"}]}]}}},{"package":{"name":"apache2","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-2ubuntu3.17+esm23"}]}],"versions":["2.4.12-2ubuntu2","2.4.17-1ubuntu1","2.4.17-2ubuntu1","2.4.17-3ubuntu1","2.4.18-1ubuntu1","2.4.18-2ubuntu1","2.4.18-2ubuntu2","2.4.18-2ubuntu3","2.4.18-2ubuntu3.1","2.4.18-2ubuntu3.2","2.4.18-2ubuntu3.3","2.4.18-2ubuntu3.4","2.4.18-2ubuntu3.5","2.4.18-2ubuntu3.7","2.4.18-2ubuntu3.8","2.4.18-2ubuntu3.9","2.4.18-2ubuntu3.10","2.4.18-2ubuntu3.12","2.4.18-2ubuntu3.13","2.4.18-2ubuntu3.14","2.4.18-2ubuntu3.15","2.4.18-2ubuntu3.17","2.4.18-2ubuntu3.17+esm1","2.4.18-2ubuntu3.17+esm2","2.4.18-2ubuntu3.17+esm3","2.4.18-2ubuntu3.17+esm4","2.4.18-2ubuntu3.17+esm5","2.4.18-2ubuntu3.17+esm6","2.4.18-2ubuntu3.17+esm7","2.4.18-2ubuntu3.17+esm8","2.4.18-2ubuntu3.17+esm9","2.4.18-2ubuntu3.17+esm10","2.4.18-2ubuntu3.17+esm11","2.4.18-2ubuntu3.17+esm12","2.4.18-2ubuntu3.17+esm13","2.4.18-2ubuntu3.17+esm14","2.4.18-2ubuntu3.17+esm16","2.4.18-2ubuntu3.17+esm17","2.4.18-2ubuntu3.17+esm18","2.4.18-2ubuntu3.17+esm19","2.4.18-2ubuntu3.17+esm20","2.4.18-2ubuntu3.17+esm21","2.4.18-2ubuntu3.17+esm22"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro","binaries":[{"binary_version":"2.4.18-2ubuntu3.17+esm23","binary_name":"apache2"},{"binary_name":"apache2-bin","binary_version":"2.4.18-2ubuntu3.17+esm23"},{"binary_version":"2.4.18-2ubuntu3.17+esm23","binary_name":"apache2-data"},{"binary_name":"apache2-suexec-custom","binary_version":"2.4.18-2ubuntu3.17+esm23"},{"binary_name":"apache2-suexec-pristine","binary_version":"2.4.18-2ubuntu3.17+esm23"},{"binary_name":"apache2-utils","binary_version":"2.4.18-2ubuntu3.17+esm23"}]},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2026-46729","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-47360","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-48005"},{"id":"CVE-2026-56153","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json"}},{"package":{"name":"apache2","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+esm14"}]}],"versions":["2.4.27-2ubuntu3","2.4.29-1ubuntu1","2.4.29-1ubuntu2","2.4.29-1ubuntu3","2.4.29-1ubuntu4","2.4.29-1ubuntu4.1","2.4.29-1ubuntu4.2","2.4.29-1ubuntu4.3","2.4.29-1ubuntu4.4","2.4.29-1ubuntu4.5","2.4.29-1ubuntu4.6","2.4.29-1ubuntu4.7","2.4.29-1ubuntu4.8","2.4.29-1ubuntu4.10","2.4.29-1ubuntu4.11","2.4.29-1ubuntu4.12","2.4.29-1ubuntu4.13","2.4.29-1ubuntu4.14","2.4.29-1ubuntu4.16","2.4.29-1ubuntu4.17","2.4.29-1ubuntu4.18","2.4.29-1ubuntu4.19","2.4.29-1ubuntu4.20","2.4.29-1ubuntu4.21","2.4.29-1ubuntu4.22","2.4.29-1ubuntu4.23","2.4.29-1ubuntu4.24","2.4.29-1ubuntu4.25","2.4.29-1ubuntu4.26","2.4.29-1ubuntu4.27","2.4.29-1ubuntu4.27+esm1","2.4.29-1ubuntu4.27+esm2","2.4.29-1ubuntu4.27+esm3","2.4.29-1ubuntu4.27+esm4","2.4.29-1ubuntu4.27+esm6","2.4.29-1ubuntu4.27+esm7","2.4.29-1ubuntu4.27+esm8","2.4.29-1ubuntu4.27+esm9","2.4.29-1ubuntu4.27+esm10","2.4.29-1ubuntu4.27+esm11","2.4.29-1ubuntu4.27+esm12","2.4.29-1ubuntu4.27+esm13"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_name":"apache2","binary_version":"2.4.29-1ubuntu4.27+esm14"},{"binary_name":"apache2-bin","binary_version":"2.4.29-1ubuntu4.27+esm14"},{"binary_name":"apache2-data","binary_version":"2.4.29-1ubuntu4.27+esm14"},{"binary_name":"apache2-suexec-custom","binary_version":"2.4.29-1ubuntu4.27+esm14"},{"binary_version":"2.4.29-1ubuntu4.27+esm14","binary_name":"apache2-suexec-pristine"},{"binary_version":"2.4.29-1ubuntu4.27+esm14","binary_name":"apache2-utils"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"id":"CVE-2026-46729","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-47360"},{"id":"CVE-2026-48005","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-56153","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json"}},{"package":{"name":"apache2","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+esm10"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4","2.4.41-4ubuntu3.5","2.4.41-4ubuntu3.6","2.4.41-4ubuntu3.7","2.4.41-4ubuntu3.8","2.4.41-4ubuntu3.9","2.4.41-4ubuntu3.10","2.4.41-4ubuntu3.11","2.4.41-4ubuntu3.12","2.4.41-4ubuntu3.13","2.4.41-4ubuntu3.14","2.4.41-4ubuntu3.15","2.4.41-4ubuntu3.16","2.4.41-4ubuntu3.17","2.4.41-4ubuntu3.19","2.4.41-4ubuntu3.20","2.4.41-4ubuntu3.21","2.4.41-4ubuntu3.23","2.4.41-4ubuntu3.23+esm2","2.4.41-4ubuntu3.23+esm3","2.4.41-4ubuntu3.23+esm4","2.4.41-4ubuntu3.23+esm5","2.4.41-4ubuntu3.23+esm6","2.4.41-4ubuntu3.23+esm7","2.4.41-4ubuntu3.23+esm8","2.4.41-4ubuntu3.23+esm9"],"ecosystem_specific":{"binaries":[{"binary_version":"2.4.41-4ubuntu3.23+esm10","binary_name":"apache2"},{"binary_name":"apache2-bin","binary_version":"2.4.41-4ubuntu3.23+esm10"},{"binary_name":"apache2-data","binary_version":"2.4.41-4ubuntu3.23+esm10"},{"binary_name":"apache2-suexec-custom","binary_version":"2.4.41-4ubuntu3.23+esm10"},{"binary_version":"2.4.41-4ubuntu3.23+esm10","binary_name":"apache2-suexec-pristine"},{"binary_name":"apache2-utils","binary_version":"2.4.41-4ubuntu3.23+esm10"},{"binary_name":"libapache2-mod-md","binary_version":"2.4.41-4ubuntu3.23+esm10"},{"binary_version":"2.4.41-4ubuntu3.23+esm10","binary_name":"libapache2-mod-proxy-uwsgi"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-46729"},{"id":"CVE-2026-47360","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-48005","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-56153"},{"id":"CVE-2026-56449","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json"}},{"package":{"name":"apache2","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1ubuntu4.26"}]}],"versions":["2.4.48-3.1ubuntu3","2.4.48-3.1ubuntu4","2.4.51-2ubuntu1","2.4.52-1ubuntu1","2.4.52-1ubuntu2","2.4.52-1ubuntu4","2.4.52-1ubuntu4.1","2.4.52-1ubuntu4.2","2.4.52-1ubuntu4.3","2.4.52-1ubuntu4.4","2.4.52-1ubuntu4.5","2.4.52-1ubuntu4.6","2.4.52-1ubuntu4.7","2.4.52-1ubuntu4.8","2.4.52-1ubuntu4.9","2.4.52-1ubuntu4.10","2.4.52-1ubuntu4.11","2.4.52-1ubuntu4.12","2.4.52-1ubuntu4.13","2.4.52-1ubuntu4.14","2.4.52-1ubuntu4.15","2.4.52-1ubuntu4.16","2.4.52-1ubuntu4.18","2.4.52-1ubuntu4.19","2.4.52-1ubuntu4.20","2.4.52-1ubuntu4.21","2.4.52-1ubuntu4.23","2.4.52-1ubuntu4.24","2.4.52-1ubuntu4.25"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"apache2","binary_version":"2.4.52-1ubuntu4.26"},{"binary_version":"2.4.52-1ubuntu4.26","binary_name":"apache2-bin"},{"binary_version":"2.4.52-1ubuntu4.26","binary_name":"apache2-data"},{"binary_version":"2.4.52-1ubuntu4.26","binary_name":"apache2-suexec-custom"},{"binary_name":"apache2-suexec-pristine","binary_version":"2.4.52-1ubuntu4.26"},{"binary_name":"apache2-utils","binary_version":"2.4.52-1ubuntu4.26"},{"binary_version":"2.4.52-1ubuntu4.26","binary_name":"libapache2-mod-md"},{"binary_name":"libapache2-mod-proxy-uwsgi","binary_version":"2.4.52-1ubuntu4.26"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json","cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[{"id":"CVE-2026-46729","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-47360"},{"id":"CVE-2026-48005","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-56153","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-56449"}]}}},{"package":{"name":"apache2","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1ubuntu8.18"}]}],"versions":["2.4.57-2ubuntu2","2.4.57-2ubuntu3","2.4.58-1ubuntu1","2.4.58-1ubuntu2","2.4.58-1ubuntu6","2.4.58-1ubuntu7","2.4.58-1ubuntu8","2.4.58-1ubuntu8.1","2.4.58-1ubuntu8.2","2.4.58-1ubuntu8.3","2.4.58-1ubuntu8.4","2.4.58-1ubuntu8.5","2.4.58-1ubuntu8.6","2.4.58-1ubuntu8.7","2.4.58-1ubuntu8.8","2.4.58-1ubuntu8.10","2.4.58-1ubuntu8.11","2.4.58-1ubuntu8.12","2.4.58-1ubuntu8.13","2.4.58-1ubuntu8.15","2.4.58-1ubuntu8.16","2.4.58-1ubuntu8.17"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"apache2","binary_version":"2.4.58-1ubuntu8.18"},{"binary_name":"apache2-bin","binary_version":"2.4.58-1ubuntu8.18"},{"binary_version":"2.4.58-1ubuntu8.18","binary_name":"apache2-data"},{"binary_version":"2.4.58-1ubuntu8.18","binary_name":"apache2-suexec-custom"},{"binary_version":"2.4.58-1ubuntu8.18","binary_name":"apache2-suexec-pristine"},{"binary_name":"apache2-utils","binary_version":"2.4.58-1ubuntu8.18"},{"binary_version":"2.4.58-1ubuntu8.18","binary_name":"libapache2-mod-md"},{"binary_version":"2.4.58-1ubuntu8.18","binary_name":"libapache2-mod-proxy-uwsgi"}]},"database_specific":{"cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-46729"},{"id":"CVE-2026-47360","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-48005","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-56153","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-56449"}],"ecosystem":"Ubuntu:24.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json"}},{"package":{"name":"apache2","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.68-1ubuntu6.1"}]}],"versions":["2.4.66-2ubuntu2","2.4.68-1ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_name":"apache2","binary_version":"2.4.68-1ubuntu6.1"},{"binary_version":"2.4.68-1ubuntu6.1","binary_name":"apache2-bin"},{"binary_version":"2.4.68-1ubuntu6.1","binary_name":"apache2-data"},{"binary_version":"2.4.68-1ubuntu6.1","binary_name":"apache2-suexec-custom"},{"binary_version":"2.4.68-1ubuntu6.1","binary_name":"apache2-suexec-pristine"},{"binary_version":"2.4.68-1ubuntu6.1","binary_name":"apache2-utils"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json","cves_map":{"cves":[{"id":"CVE-2026-56153","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-56154","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-56449","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-57941"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-58415"},{"id":"CVE-2026-59797","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-63045"},{"id":"CVE-2026-63292","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-63686","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-63718","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-73636"},{"id":"CVE-2026-73637","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-79768","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-93546","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:26.10"}}},{"package":{"name":"apache2","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/apache2?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.66-2ubuntu2.7"}]}],"versions":["2.4.64-1ubuntu3","2.4.65-3ubuntu1","2.4.66-2ubuntu1","2.4.66-2ubuntu2","2.4.66-2ubuntu2.1","2.4.66-2ubuntu2.2","2.4.66-2ubuntu2.4","2.4.66-2ubuntu2.5","2.4.66-2ubuntu2.6"],"ecosystem_specific":{"binaries":[{"binary_version":"2.4.66-2ubuntu2.7","binary_name":"apache2"},{"binary_name":"apache2-bin","binary_version":"2.4.66-2ubuntu2.7"},{"binary_version":"2.4.66-2ubuntu2.7","binary_name":"apache2-data"},{"binary_name":"apache2-suexec-custom","binary_version":"2.4.66-2ubuntu2.7"},{"binary_name":"apache2-suexec-pristine","binary_version":"2.4.66-2ubuntu2.7"},{"binary_name":"apache2-utils","binary_version":"2.4.66-2ubuntu2.7"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9016-1.json","cves_map":{"ecosystem":"Ubuntu:26.04:LTS","cves":[{"id":"CVE-2026-46729","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-47360"},{"id":"CVE-2026-48005","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-56153","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-56449"}]}}}],"schema_version":"1.9.2"}