UBUNTU-CVE-2026-63686: Null Pointer Dereference

Q: Which deployments are exposed to this issue?

Ubuntu systems running Apache HTTP Server with mod_xml2enc before version 2.4.69 are affected when they proxy responses from backend servers. The issue applies on all platforms.

Q: What does an attacker need to exploit it?

An attacker needs to control or act as an untrusted backend server that Apache proxies to. They must return a proxied response with a charset that causes conversion to partially succeed and then fail.

Q: What is the impact of successful exploitation?

Successful exploitation can cause a denial of service through a NULL pointer dereference. The provided severity vector indicates no authentication or user interaction is required.

Q: What should be done if immediate upgrading is not possible?

The provided information identifies upgrading Apache HTTP Server to version 2.4.69 as the fix. No alternative mitigation is provided.

Published Oct 1, 2026

Updated

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

8 affected componentsFixes available

ubuntu/apache2<2.4.7-1ubuntu4.22+esm17

2.4.7-1ubuntu4.22+esm17

ubuntu/apache2<2.4.18-2ubuntu3.17+esm22

2.4.18-2ubuntu3.17+esm22

ubuntu/apache2<2.4.29-1ubuntu4.27+esm13

2.4.29-1ubuntu4.27+esm13

ubuntu/apache2<2.4.41-4ubuntu3.23+esm9

2.4.41-4ubuntu3.23+esm9

ubuntu/apache2<2.4.52-1ubuntu4.25

2.4.52-1ubuntu4.25

ubuntu/apache2<2.4.58-1ubuntu8.17

2.4.58-1ubuntu8.17

ubuntu/apache2*

ubuntu/apache2<2.4.66-2ubuntu2.6

2.4.66-2ubuntu2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.7-1ubuntu4.22+esm17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.18-2ubuntu3.17+esm22
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.29-1ubuntu4.27+esm13
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.41-4ubuntu3.23+esm9
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.52-1ubuntu4.25
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.58-1ubuntu8.17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-2ubuntu2.6
Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Ubuntu systems running Apache HTTP Server with mod_xml2enc before version 2.4.69 are affected when they proxy responses from backend servers. The issue applies on all platforms.

What does an attacker need to exploit it?

An attacker needs to control or act as an untrusted backend server that Apache proxies to. They must return a proxied response with a charset that causes conversion to partially succeed and then fail.

What is the impact of successful exploitation?

Successful exploitation can cause a denial of service through a NULL pointer dereference. The provided severity vector indicates no authentication or user interaction is required.

What should be done if immediate upgrading is not possible?

The provided information identifies upgrading Apache HTTP Server to version 2.4.69 as the fix. No alternative mitigation is provided.

UBUNTU-CVE-2026-63686: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done if immediate upgrading is not possible?