UBUNTU-CVE-2026-79768: Medium severity ubuntu/apache2 vulnerability

Q: Which Apache deployments are affected?

Affected deployments run Apache HTTP Server versions 2.4.0 through 2.4.68 and have mod_userdir configured with an absolute, non-wildcard UserDir directive.

Q: What does an attacker need to exploit this issue?

The reported vector is network-accessible and requires neither authentication nor user interaction. The issue is associated with path equivalence involving '/./' requests.

Q: How can I check whether my configuration is exposed?

Review the active mod_userdir configuration for a UserDir directive using the absolute non-wildcard form. If that configuration is present on an Apache version in the affected range, the deployment matches the stated affected conditions.

Published Oct 1, 2026

Updated

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected Software

8 affected componentsFixes available

ubuntu/apache2<2.4.7-1ubuntu4.22+esm17

2.4.7-1ubuntu4.22+esm17

ubuntu/apache2<2.4.18-2ubuntu3.17+esm22

2.4.18-2ubuntu3.17+esm22

ubuntu/apache2<2.4.29-1ubuntu4.27+esm13

2.4.29-1ubuntu4.27+esm13

ubuntu/apache2<2.4.41-4ubuntu3.23+esm9

2.4.41-4ubuntu3.23+esm9

ubuntu/apache2<2.4.52-1ubuntu4.25

2.4.52-1ubuntu4.25

ubuntu/apache2<2.4.58-1ubuntu8.17

2.4.58-1ubuntu8.17

ubuntu/apache2*

ubuntu/apache2<2.4.66-2ubuntu2.6

2.4.66-2ubuntu2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.7-1ubuntu4.22+esm17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.18-2ubuntu3.17+esm22
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.29-1ubuntu4.27+esm13
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.41-4ubuntu3.23+esm9
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.52-1ubuntu4.25
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.58-1ubuntu8.17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-2ubuntu2.6

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Apache deployments are affected?

Affected deployments run Apache HTTP Server versions 2.4.0 through 2.4.68 and have mod_userdir configured with an absolute, non-wildcard UserDir directive.

What does an attacker need to exploit this issue?

The reported vector is network-accessible and requires neither authentication nor user interaction. The issue is associated with path equivalence involving '/./' requests.

How can I check whether my configuration is exposed?

Review the active mod_userdir configuration for a UserDir directive using the absolute non-wildcard form. If that configuration is present on an Apache version in the affected range, the deployment matches the stated affected conditions.

UBUNTU-CVE-2026-79768: Medium severity ubuntu/apache2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Apache deployments are affected?

What does an attacker need to exploit this issue?

How can I check whether my configuration is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which Apache deployments are affected?

What does an attacker need to exploit this issue?

How can I check whether my configuration is exposed?