https://seclists.org/oss-sec/2026/q4/15: CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

Q: Which Apache HTTP Server versions need to be remediated?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected. Version 2.4.69 was released with the fix, which was also applied in the 2.4.x branch by revision r1938658.

Q: Is this issue relevant if mod_charset_lite is not in use?

The vulnerability is in mod_charset_lite. The provided information does not state whether configurations that do not load or use this module are affected.

Q: When was the issue fixed and disclosed?

The issue was reported on 2026-06-09 and fixed on 2026-10-01. Apache HTTP Server 2.4.69 was released on the same date.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which Apache HTTP Server versions need to be remediated?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected. Version 2.4.69 was released with the fix, which was also applied in the 2.4.x branch by revision r1938658.

Is this issue relevant if mod_charset_lite is not in use?

The vulnerability is in mod_charset_lite. The provided information does not state whether configurations that do not load or use this module are affected.

When was the issue fixed and disclosed?

The issue was reported on 2026-06-09 and fixed on 2026-10-01. Apache HTTP Server 2.4.69 was released on the same date.