BIT-apache-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions before 2.4.69 are affected on all platforms when mod_xml2enc processes a proxied response from an untrusted backend server. The issue is limited to the described charset-conversion path.

Q: What must an attacker control to trigger the denial of service?

An attacker needs control of, or the ability to make Apache proxy content from, a backend server that can return a response with a charset whose conversion partially succeeds and then fails. No authentication or user interaction is required according to the supplied severity vector.

Q: What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.

Published Oct 1, 2026

Updated

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

1 affected component

Apache HTTP Server<2.4.69

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·04:20 PM

Data Sourced

via OSV·04:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions before 2.4.69 are affected on all platforms when mod_xml2enc processes a proxied response from an untrusted backend server. The issue is limited to the described charset-conversion path.

What must an attacker control to trigger the denial of service?

An attacker needs control of, or the ability to make Apache proxy content from, a backend server that can return a response with a charset whose conversion partially succeeds and then fails. No authentication or user interaction is required according to the supplied severity vector.

What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.

BIT-apache-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to trigger the denial of service?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to trigger the denial of service?

What is the recommended remediation?