CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
Published Oct 1, 2026
·Updated
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Affected Software
1 affected component
Apache HTTP Server>=2.4.0<=2.4.68
Event History
Oct 1, 2026
CVE Published
via MITRE·04:07 PM
Data Sourced
via MITRE·04:07 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
The issue affects Apache HTTP Server on Windows in versions 2.4.0 through 2.4.68. The described condition involves processing paths that use 8.3 names and expand to longer names.
2
What input condition is associated with exploitation?
The vulnerable path handling occurs while Apache HTTP Server processes paths containing 8.3 names that may grow when expanded. The available information does not state whether authentication or any particular Apache configuration is required.