UBUNTU-CVE-2026-47360: High severity ubuntu/apache2 vulnerability

Published Oct 1, 2026

Updated

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected Software

8 affected components

ubuntu/apache2*

Event History

Oct 1, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server deployments using the mod_session_cookie module are affected if they run a version from 2.4.0 through 2.4.68 and use internal redirects where SessionCookieRemove changes. The issue can result in a session cookie being passed to a backend server despite its removal setting changing.

Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network attack access with low attack complexity, no privileges required, and no user interaction required.

What is the primary security impact?

The impact is exposure of sensitive information: a session cookie that should have been removed can be sent to a backend server. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

UBUNTU-CVE-2026-47360: High severity ubuntu/apache2 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the primary security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the primary security impact?