CVE-2026-43951 Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

🗓️ 08 Jun 2026 15:16:14Reported by apacheType

Apache HTTP Server OOB read in merge_response_headers may crash via mod_headers and mod_mime.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server	16 Jun 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server	23 Jun 202616:13	–	ibm
FreeBSD	Apache httpd -- Multiple vulnerabilities	8 Jun 202600:00	–	freebsd
ATTACKERKB	CVE-2026-43951	8 Jun 202615:16	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2026-1880)	22 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpd, --advisory ALAS2-2026-3379 (ALAS-2026-3379)	22 Jun 202600:00	–	nessus
Tenable Nessus	Apache 2.4.x < 2.4.68 Multiple Vulnerabilities	8 Jun 202600:00	–	nessus
Tenable Nessus	Debian dla-4629 : apache2 - security update	12 Jun 202600:00	–	nessus
Tenable Nessus	FreeBSD : Apache httpd -- Multiple vulnerabilities (7655baae-637d-11f1-8607-8447094a420f)	9 Jun 202600:00	–	nessus
Tenable Nessus	Photon OS 5.0: Httpd PHSA-2026-5.0-0881	16 Jun 202600:00	–	nessus

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.67",
        "status": "affected",
        "version": "2.4.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
httpd	www.httpd.apache.org/security/vulnerabilities_24.html

08 Jun 2026 15:16Current

EPSS0.00525

CWE-125