UBUNTU-CVE-2026-56449: High severity ubuntu/apache2 vulnerability

Published Oct 1, 2026

Updated

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.

Affected Software

8 affected components

ubuntu/apache2*

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed?

Deployments running Apache HTTP Server 2.4.68 with the mod_proxy_html module in use are exposed to crafted HTTP response bodies processed by that module. The affected Ubuntu software package is apache2.

What does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. An attacker needs to cause mod_proxy_html to process a crafted HTTP response body.

What is the likely impact of successful exploitation?

The vulnerability is an out-of-bounds write and is rated high severity with a 7.5 score. The supplied vector indicates high confidentiality impact, with no stated integrity or availability impact.

UBUNTU-CVE-2026-56449: High severity ubuntu/apache2 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?