SUSE-SU-2026:5077-1: Security update for apache2

This update for apache2 fixes the following issues:

- CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed (bsc#1284043). - CVE-2026-42528: memory calculation bug in moddav allows an attacker with permission to create WebDAV locks to crash server child processes (bsc#1284044). - CVE-2026-46729: NULL pointer dereference in modheartmonitor over unicast listener (bsc#1284045). - CVE-2026-47360: session cookie passed to a backend server when SessionCookieRemove changes across internal redirects (bsc#1284046). - CVE-2026-48005: missing authentication checks in modauthdigest allows an unauthenticated remote client to cause a DoS via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck (bsc#1284047). - CVE-2026-56153: out-of-bounds write in modcharsetlite (bsc#1284048). - CVE-2026-56154: use-after-free in modrewrite when using lookahead (%{LA-U:HTTP:...}) (bsc#1284049). - CVE-2026-57941: use-after-free in modhttp2 via shared session->bbtmp re-entrancy (bsc#1284050). - CVE-2026-58415: internal state files accessible to external parties in moddavfs allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory (bsc#1284051). - CVE-2026-59797: improper privilege management in modssl when using SSLRequire and file-related expressions (bsc#1284059). - CVE-2026-63045: improper validation of FTP PASV reply address in modproxyftp allows an untrusted FTP server to cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060). - CVE-2026-63292: stack-based buffer overflow in modvhostalias allows a remote client to cause a DoS or potentially execute arbitrary code via an HTTP request with a specially crafted Host header (bsc#1284061). - CVE-2026-63686: NULL pointer dereference in modxml2enc allows an untrusted backend server to cause a denial of service via a crafted proxied response (bsc#1284058). - CVE-2026-63718: inconsistent interpretation of HTTP requests in modproxyuwsgi allows for response smuggling via a crafted uwsgi response with Transfer-Encoding (bsc#1284057). - CVE-2026-73636: authentication bypass by capture-replay in modauthdigest allows a MiTM attacker to replay captured digest authentication credentials via crafted requests (bsc#1284056). - CVE-2026-73637: use-after-free in modauthdigest allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests (bsc#1284055). - CVE-2026-79768: path equivalence issue in the moduserdir module when configured with absolute non-wildcard UserDir directive (bsc#1284054). - CVE-2026-93546: integer overflow in moddavfs allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database (bsc#1284053).