https://seclists.org/oss-sec/2026/q4/10: CVE-2026-42356: Apache HTTP Server: limited RCE for some internal dicts to non-CGI files in CGI dictories

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.60 through 2.4.68 are affected. Exploitation is limited to targets located in directories where CGI is enabled.

Q: What conditions are required for an attacker to trigger execution?

A CGI program must cause an internal redirect to the target. The target must be in a CGI-enabled directory and must not have another extension that mod_mime recognizes.

Q: Are ordinary non-CGI files generally affected?

No. The vulnerable behavior applies only when certain internal redirects from CGI programs target files in CGI-enabled directories under the specified extension-handling condition.

Q: What version contains the fix?

Apache HTTP Server 2.4.69 was released with the fix. The fix was made in the 2.4.x branch on 2026-10-01 as revision r1938650.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.60<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.60 through 2.4.68 are affected. Exploitation is limited to targets located in directories where CGI is enabled.

What conditions are required for an attacker to trigger execution?

A CGI program must cause an internal redirect to the target. The target must be in a CGI-enabled directory and must not have another extension that mod_mime recognizes.

Are ordinary non-CGI files generally affected?

No. The vulnerable behavior applies only when certain internal redirects from CGI programs target files in CGI-enabled directories under the specified extension-handling condition.

What version contains the fix?

Apache HTTP Server 2.4.69 was released with the fix. The fix was made in the 2.4.x branch on 2026-10-01 as revision r1938650.