SUSE-SU-2026:5099-1: Security update for apache2

Q: Which Apache configurations have explicitly identified exposure conditions?

WebDAV deployments are affected by the mod_dav issue only when an attacker has permission to create WebDAV locks. The mod_auth_digest denial of service requires Digest authentication to be enabled with AuthDigestNcCheck, while the mod_rewrite issue requires use of lookahead %{LA-U:HTTP:...}; mod_heartmonitor is affected over a unicast listener.

Q: Can an unauthenticated remote client trigger any of these issues?

Yes. The mod_auth_digest flaw allows an unauthenticated remote client to cause denial of service using forged Authorization headers, but only when Digest authentication and AuthDigestNcCheck are enabled. Other listed issues have different stated prerequisites, including WebDAV lock-creation permission or particular module and configuration use.

Q: What is the likely operational impact of the WebDAV and Digest-authentication flaws?

The mod_dav memory calculation bug can crash Apache server child processes when exploited by an attacker permitted to create WebDAV locks. The mod_auth_digest issue can cause a denial of service through forged Authorization headers under the specified Digest authentication configuration.

Published Nov 4, 2026

Updated

This update for apache2 fixes the following issues:

- CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed (bsc#1284043). - CVE-2026-42528: memory calculation bug in moddav allows an attacker with permission to create WebDAV locks to crash server child processes (bsc#1284044). - CVE-2026-46729: NULL pointer dereference in modheartmonitor over unicast listener (bsc#1284045). - CVE-2026-47360: session cookie passed to a backend server when SessionCookieRemove changes across internal redirects (bsc#1284046). - CVE-2026-48005: missing authentication checks in modauthdigest allows an unauthenticated remote client to cause a DoS via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck (bsc#1284047). - CVE-2026-56153: out-of-bounds write in modcharsetlite (bsc#1284048). - CVE-2026-56154: use-after-free in modrewrite when using lookahead (%{LA-U:HTTP:...}) (bsc#1284049). - CVE-2026-57941: use-after-free in modhttp2 via shared session->bbtmp re-entrancy (bsc#1284050). - CVE-2026-58415: internal state files accessible to external parties in moddavfs allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory (bsc#1284051). - CVE-2026-59797: improper privilege management in modssl when using SSLRequire and file-related expressions (bsc#1284059). - CVE-2026-63045: improper validation of FTP PASV reply address in modproxyftp allows an untrusted FTP server to cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060). - CVE-2026-63292: stack-based buffer overflow in modvhostalias allows a remote client to cause a DoS or potentially execute arbitrary code via an HTTP request with a specially crafted Host header (bsc#1284061). - CVE-2026-63686: NULL pointer dereference in modxml2enc allows an untrusted backend server to cause a denial of service via a crafted proxied response (bsc#1284058). - CVE-2026-63718: inconsistent interpretation of HTTP requests in modproxyuwsgi allows for response smuggling via a crafted uwsgi response with Transfer-Encoding (bsc#1284057). - CVE-2026-73636: authentication bypass by capture-replay in modauthdigest allows a MiTM attacker to replay captured digest authentication credentials via crafted requests (bsc#1284056). - CVE-2026-73637: use-after-free in modauthdigest allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests (bsc#1284055). - CVE-2026-79768: path equivalence issue in the moduserdir module when configured with absolute non-wildcard UserDir directive (bsc#1284054). - CVE-2026-93546: integer overflow in moddavfs allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database (bsc#1284053).

Other sources

This update for apache2 fixes the following issues: CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed (bsc#1284043). CVE-2026-42528: memory calculation bug in moddav allows an attacker with permission to create WebDAV locks to crash server child processes (bsc#1284044). CVE-2026-46729: NULL pointer dereference in modheartmonitor over unicast listener (bsc#1284045). CVE-2026-47360: session cookie passed to a backend server when SessionCookieRemove changes across internal redirects (bsc#1284046). CVE-2026-48005: missing authentication checks in modauthdigest allows an unauthenticated remote client to cause a DoS via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck (bsc#1284047). CVE-2026-56153: out-of-bounds write in modcharsetlite (bsc#1284048). CVE-2026-56154: use-after-free in modrewrite when using lookahead (%{LA-U:HTTP:...}) (bsc#1284049). CVE-2026-57941: use-after-free in modhttp2 via shared session->bbtmp re-entrancy (bsc#1284050). CVE-2026-58415: internal state files accessible to external parties in moddavfs allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory (bsc#1284051). CVE-2026-59797: improper privilege management in modssl when using SSLRequire and file-related expressions (bsc#1284059). CVE-2026-63045: improper validation of FTP PASV reply address in modproxyftp allows an untrusted FTP server to cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060). CVE-2026-63292: stack-based buffer overflow in modvhostalias allows a remote client to cause a DoS or potentially execute arbitrary code via an HTTP request with a specially crafted Host header (bsc#1284061). CVE-2026-63686: NULL pointer dereference in modxml2enc allows an untrusted backend server to cause a denial of service via a crafted proxied response (bsc#1284058). CVE-2026-63718: inconsistent interpretation of HTTP requests in modproxyuwsgi allows for response smuggling via a crafted uwsgi response with Transfer-Encoding (bsc#1284057). CVE-2026-73636: authentication bypass by capture-replay in modauthdigest allows a MiTM attacker to replay captured digest authentication credentials via crafted requests (bsc#1284056). CVE-2026-73637: use-after-free in modauthdigest allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests (bsc#1284055). CVE-2026-79768: path equivalence issue in the moduserdir module when configured with absolute non-wildcard UserDir directive (bsc#1284054). CVE-2026-93546: integer overflow in moddavfs allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database (bsc#1284053).

— SUSE

Affected Software

56 affected componentsFixes available

suse/apache2<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13<2.4.66-35.84.1

2.4.66-35.84.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)

Any of the following

suse/apache2-debugsource<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-worker-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-worker<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-debugsource<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-prefork-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-utils-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-worker-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-devel<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-utils-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-worker<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-example-pages<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-devel<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-utils<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-prefork<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-prefork-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-prefork<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-utils<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-example-pages<2.4.66-35.84.1

2.4.66-35.84.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)

Any of the following

suse/apache2-doc<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-doc<2.4.66-35.84.1

2.4.66-35.84.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)

Any of the following

suse/apache2-debugsource<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-worker-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-worker<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-debugsource<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-prefork-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-utils-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-worker-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-devel<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-utils-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-worker<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-example-pages<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-devel<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-utils<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-prefork<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-prefork-debuginfo<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-prefork<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-utils<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-example-pages<2.4.66-35.84.1

2.4.66-35.84.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)

Any of the following

suse/apache2-doc<2.4.66-35.84.1

2.4.66-35.84.1

suse/apache2-tls13-doc<2.4.66-35.84.1

2.4.66-35.84.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13 to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-debugsource to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-worker-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-worker to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-debugsource to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-prefork-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-utils-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-worker-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-devel to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-utils-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-worker to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-example-pages to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-devel to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-utils to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-prefork to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-prefork-debuginfo to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-prefork to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-utils to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-example-pages to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-doc to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade suse/apache2-tls13-doc to a version that resolves this vulnerability.
Fixed in 2.4.66-35.84.1
Upgrade
Upgrade apache2 to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-5099
Upgrade
Upgrade apache2 to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-5099

Event History

Nov 4, 2026

Advisory Published

via OSV·05:55 PM

Data Sourced

via OSV·05:55 PM

DescriptionAffected Software

Advisory Published

via SUSE·05:55 PM

Data Sourced

via SUSE·05:55 PM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which Apache configurations have explicitly identified exposure conditions?

WebDAV deployments are affected by the mod_dav issue only when an attacker has permission to create WebDAV locks. The mod_auth_digest denial of service requires Digest authentication to be enabled with AuthDigestNcCheck, while the mod_rewrite issue requires use of lookahead %{LA-U:HTTP:...}; mod_heartmonitor is affected over a unicast listener.

Can an unauthenticated remote client trigger any of these issues?

Yes. The mod_auth_digest flaw allows an unauthenticated remote client to cause denial of service using forged Authorization headers, but only when Digest authentication and AuthDigestNcCheck are enabled. Other listed issues have different stated prerequisites, including WebDAV lock-creation permission or particular module and configuration use.

What is the likely operational impact of the WebDAV and Digest-authentication flaws?

The mod_dav memory calculation bug can crash Apache server child processes when exploited by an attacker permitted to create WebDAV locks. The mod_auth_digest issue can cause a denial of service through forged Authorization headers under the specified Digest authentication configuration.

SUSE-SU-2026:5099-1: Security update for apache2

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Apache configurations have explicitly identified exposure conditions?

Can an unauthenticated remote client trigger any of these issues?

What is the likely operational impact of the WebDAV and Digest-authentication flaws?

Company

Resources

Contact

Frequently Asked Questions

Which Apache configurations have explicitly identified exposure conditions?

Can an unauthenticated remote client trigger any of these issues?

What is the likely operational impact of the WebDAV and Digest-authentication flaws?