USN-9090-1: Apache HTTP Server vulnerabilities
Zhenpeng Lin discovered that Apache HTTP Server's moddav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42528) It was discovered that Apache HTTP Server's modvhostalias module incorrectly handled certain requests, leading to a one-byte stack buffer overflow. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-109163) It was discovered that Apache HTTP Server's modmd module incorrectly handled certain conditions, leading to a NULL pointer dereference. An attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-106023) It was discovered that Apache HTTP Server's modhttp2 module incorrectly handled certain request headers, leading to heap corruption. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119618) Feliks Penconek, Yang Song, and JiaSheng He discovered that Apache HTTP Server could treat the target of some internal redirects from CGI programs as a CGI program. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-42356)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.68-1ubuntu6.2 - Upgrade
Upgrade
ubuntu/apache2-binto a version that resolves this vulnerability.Fixed in 2.4.68-1ubuntu6.2 - Upgrade
Upgrade
ubuntu/apache2-devto a version that resolves this vulnerability.Fixed in 2.4.68-1ubuntu6.2 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.66-2ubuntu2.8 - Upgrade
Upgrade
ubuntu/apache2-binto a version that resolves this vulnerability.Fixed in 2.4.66-2ubuntu2.8 - Upgrade
Upgrade
ubuntu/apache2-devto a version that resolves this vulnerability.Fixed in 2.4.66-2ubuntu2.8 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.58-1ubuntu8.19 - Upgrade
Upgrade
ubuntu/apache2-binto a version that resolves this vulnerability.Fixed in 2.4.58-1ubuntu8.19 - Upgrade
Upgrade
ubuntu/apache2-devto a version that resolves this vulnerability.Fixed in 2.4.58-1ubuntu8.19 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.52-1ubuntu4.27 - Upgrade
Upgrade
ubuntu/apache2-binto a version that resolves this vulnerability.Fixed in 2.4.52-1ubuntu4.27 - Upgrade
Upgrade
ubuntu/apache2-devto a version that resolves this vulnerability.Fixed in 2.4.52-1ubuntu4.27 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/apache2-binto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/apache2-devto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What access does an attacker need to trigger the WebDAV lock issue?
The attacker needs permission to create WebDAV locks. Successful exploitation could crash Apache HTTP Server and cause a denial of service.
Can the mod_vhost_alias issue be attacked remotely?
Yes. The issue can be triggered by a remote attacker using certain requests, and could lead to a crash or possibly arbitrary code execution.
Which Ubuntu releases are affected by the mod_md NULL pointer dereference?
This issue affects Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.