https://seclists.org/oss-sec/2026/q4/13: CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not moved during internal dict

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when using the mod_session_cookie module and an internal redirect causes the SessionCookieRemove setting to change.

Q: What must occur for a backend server to receive the session cookie?

The issue occurs when SessionCookieRemove changes across an internal redirect. In that situation, the session cookie may still be forwarded to a backend server despite the changed removal setting.

Q: What fixed version is available?

Apache HTTP Server 2.4.69 includes the fix. The fix was made in the 2.4.x branch on 2026-10-01 in revision r1938656.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when using the mod_session_cookie module and an internal redirect causes the SessionCookieRemove setting to change.

What must occur for a backend server to receive the session cookie?

The issue occurs when SessionCookieRemove changes across an internal redirect. In that situation, the session cookie may still be forwarded to a backend server despite the changed removal setting.

What fixed version is available?

Apache HTTP Server 2.4.69 includes the fix. The fix was made in the 2.4.x branch on 2026-10-01 in revision r1938656.