https://seclists.org/oss-sec/2026/q4/28: CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosu

Q: Which deployments are affected?

Affected deployments run Apache HTTP Server 2.4.0 through 2.4.68 and have mod_userdir configured with an absolute, non-wildcard UserDir directive. Deployments not using that UserDir configuration are not identified as affected.

Q: What configuration should be checked during triage?

Inspect the mod_userdir configuration for the second UserDir form: an absolute path that is not a wildcard pattern. Also confirm the running Apache HTTP Server version is within 2.4.0 through 2.4.68.

Q: What version contains the fix?

Apache HTTP Server 2.4.69 includes the fix. The issue was fixed in the 2.4.x branch by revision r1938680 on 2026-10-01.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are affected?

Affected deployments run Apache HTTP Server 2.4.0 through 2.4.68 and have mod_userdir configured with an absolute, non-wildcard UserDir directive. Deployments not using that UserDir configuration are not identified as affected.

What configuration should be checked during triage?

Inspect the mod_userdir configuration for the second UserDir form: an absolute path that is not a wildcard pattern. Also confirm the running Apache HTTP Server version is within 2.4.0 through 2.4.68.

What version contains the fix?

Apache HTTP Server 2.4.69 includes the fix. The issue was fixed in the 2.4.x branch by revision r1938680 on 2026-10-01.