CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
Apache HTTP Server: Out-of-Bounds Write in apdirectorywalk() Canonical-Name Rewrite on CASEBLINDFILESYSTEM
Other sources
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects Apache HTTP Server on Windows in versions 2.4.0 through 2.4.68. The described condition involves processing paths that use 8.3 names and expand to longer names.
What input condition is associated with exploitation?
The vulnerable path handling occurs while Apache HTTP Server processes paths containing 8.3 names that may grow when expanded. The available information does not state whether authentication or any particular Apache configuration is required.