CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.60 through 2.4.68 are affected where CGI programs can perform the relevant internal redirects. The redirect target must be located in a CGI-enabled directory.

Q: What conditions must be met for code execution?

A CGI program must issue one of the affected internal redirects to a non-CGI target. That target must be in a CGI-enabled directory and must not have an extension that mod_mime recognizes.

Q: Are files outside CGI-enabled directories affected?

No. The described behavior requires the redirect target to already be in a directory enabled for CGI.

Published Oct 1, 2026

Updated

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime.

This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.

Affected Software

1 affected component

Apache HTTP Server>=2.4.60<=2.4.68

Event History

Oct 1, 2026

CVE Published

via MITRE·03:54 PM

Data Sourced

via MITRE·03:54 PM

DescriptionWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.60 through 2.4.68 are affected where CGI programs can perform the relevant internal redirects. The redirect target must be located in a CGI-enabled directory.

What conditions must be met for code execution?

A CGI program must issue one of the affected internal redirects to a non-CGI target. That target must be in a CGI-enabled directory and must not have an extension that mod_mime recognizes.

Are files outside CGI-enabled directories affected?