https://seclists.org/oss-sec/2026/q4/24: CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failu

Q: Which deployments are exposed to this denial of service?

Apache HTTP Server 2.4.0 through 2.4.68 is affected on all platforms when mod_xml2enc processes a proxied response from an untrusted backend server.

Q: What does an attacker need to trigger the crash?

The attacker needs control of, or the ability to act as, a backend server whose response is proxied by the affected Apache HTTP Server. The proxied response must use a charset for which conversion partially succeeds and then fails.

Q: What is the remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Apache HTTP Server 2.4.0 through 2.4.68 is affected on all platforms when mod_xml2enc processes a proxied response from an untrusted backend server.

What does an attacker need to trigger the crash?

The attacker needs control of, or the ability to act as, a backend server whose response is proxied by the affected Apache HTTP Server. The proxied response must use a charset for which conversion partially succeeds and then fails.

What is the remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.