CVE-2026-63686 – Apache HTTP Server
“Fourteen flaws, one web server, and three Critical doors left open: every unpatched Apache instance is an invitation.”
Apache HTTP Server 2.4.69 fixes 14 vulnerabilities that affect versions 2.4.0 through 2.4.68. Three are Critical: CVE-2026-56154, a use-after-free in mod_rewrite lookahead, has a CVSS score of 9.8, Critical severity; CVE-2026-57941, a use-after-free in mod_http2, has a CVSS score of 9.8, Critical severity; and CVE-2026-59797, an improper privilege management flaw in mod_ssl, has a CVSS score of 9.8, Critical severity. Most of the flaws in this release are classified as remote code execution or elevation of privilege risks.
The remaining 11 are High severity. CVE-2026-93546 (mod_dav_fs integer overflow) has a CVSS score of 8.8, High severity. CVE-2026-73636 (mod_auth_digest credential replay) has a CVSS score of 8.1, High severity. CVE-2026-73637 (mod_auth_digest use-after-free) has a CVSS score of 7.3, High severity. CVE-2026-46729 (mod_heartmonitor), CVE-2026-48005 (mod_auth_digest), CVE-2026-56153 (mod_charset_lite), CVE-2026-56449 (mod_proxy_html), CVE-2026-59685 (Windows 8.3 path handling), CVE-2026-63045 (mod_proxy_ftp), CVE-2026-63292 (mod_vhost_alias) and CVE-2026-63686 (mod_xml2enc) each have a CVSS score of 7.5, High severity. Together they cover memory corruption, authentication bypass, proxy abuse, and denial of service across core modules.
Key Details
- Affected Product
- Apache Http Server
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-476