BIT-apache-2026-44631: Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

Q: Which deployments are affected?

Apache HTTP Server versions 2.4.0 through 2.4.67 are affected. Version 2.4.68 fixes the issue.

Q: What must an attacker do to exploit this issue?

The vulnerability is triggered through crafted regular expressions in the Apache HTTP Server configuration. The provided data does not state how an attacker would cause such expressions to be present in a target configuration.

Q: What should be done if the server is vulnerable?

Upgrade Apache HTTP Server to version 2.4.68, which is identified as the fixed version.

Published Jun 8, 2026

Updated

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.67

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.68

Event History

Jun 8, 2026

CVE Published

via OSV·03:19 PM

Data Sourced

via OSV·03:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Apache HTTP Server versions 2.4.0 through 2.4.67 are affected. Version 2.4.68 fixes the issue.

What must an attacker do to exploit this issue?

The vulnerability is triggered through crafted regular expressions in the Apache HTTP Server configuration. The provided data does not state how an attacker would cause such expressions to be present in a target configuration.

What should be done if the server is vulnerable?

Upgrade Apache HTTP Server to version 2.4.68, which is identified as the fixed version.

BIT-apache-2026-44631: Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What should be done if the server is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What should be done if the server is vulnerable?