CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Published Oct 1, 2026
·Updated
Apache HTTP Server: modsession: Session cookie not removed during internal redirect
Other sources
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module.
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
— MITRE
Affected Software
3 affected componentsFixes available
Apache HTTP Server>=2.4.0<=2.4.68
Apache HTTP Server>=2.4.60<2.4.69
Microsoft azl3 httpd 2.4.68-1<2.4.69-1
2.4.69-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1
Event History
Oct 1, 2026
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeaknessAffected Software
Oct 9, 2026
Data Sourced
via Microsoft·08:18 AM
DescriptionSeverityWeaknessAffected Software