https://seclists.org/oss-sec/2026/q4/20: CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_dictory_walk() Canonical-Name write on CASE_BLIND_FILESYSTEM

Q: Which deployments are exposed to this vulnerability?

Apache HTTP Server installations running on Windows are affected if they use versions 2.4.0 through 2.4.68. The issue is tied to processing paths containing 8.3 names that can grow when expanded on a case-blind filesystem.

Q: What version fixes the issue?

Apache HTTP Server 2.4.69 fixes the vulnerability. The fix was made in the 2.4.x branch by revision r1938670 on 2026-10-01.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this vulnerability?

Apache HTTP Server installations running on Windows are affected if they use versions 2.4.0 through 2.4.68. The issue is tied to processing paths containing 8.3 names that can grow when expanded on a case-blind filesystem.

What version fixes the issue?

Apache HTTP Server 2.4.69 fixes the vulnerability. The fix was made in the 2.4.x branch by revision r1938670 on 2026-10-01.

https://seclists.org/oss-sec/2026/q4/20: CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_dictory_walk() Canonical-Name write on CASE_BLIND_FILESYSTEM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this vulnerability?

What version fixes the issue?

Company

Resources

Contact