https://seclists.org/oss-sec/2026/q4/21: CVE-2026-59797: Apache HTTP Server: mod_ssl SSLquiallows .htaccess ap_expr file-function

Q: Which Apache HTTP Server versions need remediation?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected. The issue was fixed in the 2.4.x branch by revision r1938672, and version 2.4.69 was released with the fix.

Q: What configuration area is involved in exploitation?

The vulnerability is in mod_ssl and involves SSLRequire directives and file-related ap_expr expressions. The advisory specifically indicates that .htaccess use is relevant to the issue.

Q: How severe is this issue according to the advisory?

The advisory rates the issue as low severity.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which Apache HTTP Server versions need remediation?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected. The issue was fixed in the 2.4.x branch by revision r1938672, and version 2.4.69 was released with the fix.

What configuration area is involved in exploitation?

The vulnerability is in mod_ssl and involves SSLRequire directives and file-related ap_expr expressions. The advisory specifically indicates that .htaccess use is relevant to the issue.

How severe is this issue according to the advisory?

The advisory rates the issue as low severity.