CVE-2026-33523

A flaw was found in httpd. When processing responses from an untrusted or compromised backend server, multiple modules fail to sanitize Carriage Return and Line Feed CRLF sequences in the HTTP status line. This issue leads to an HTTP response splitting attack. Mitigation To mitigate this issue,...

CVE-2026-29169

A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request. Mitigation Disabling moddavlock and restarting httpd will mitigate this flaw...

CVE-2026-29168

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0848

Updates of 'httpd' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0848

Updates of 'httpd' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-0848

Updates of 'httpd', 'gpsd' packages of Photon OS have been released...

Tenda AC6 operating system command injection vulnerability

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the getlogfile function in the httpd component, which processes the wans.flag parameter. Currently, no detailed...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38719)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the fromSetWirelessRepeat function in the httpd component’s goform/WifiExtraSet module, which processes parameters...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38718)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the formWifiApScan function in the httpd component’s/goform/WifiApScan file, which fails to properly validate the...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38720)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from an unknown function in the httpd component, specifically the file/goform/telnet, which manipulates the parameter...

CVE-2026-34032

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

CVE-2026-33007

A flaw was found in the modauthnsocache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration. Mitigation Disabling modauthnsocache and restarting...

Exploit for Double Free in Apache Http_Server

CVE-2026-23918 Double-free in Apache httpd modhttp2 stream c...

CLSA-2026-1778490923 httpd: Fix of 9 CVEs

CVE-2026-33857: fix length checks in AJP msgget functions - CVE-2026-34032: fix ajpmsggetstring buffer checks - CVE-2026-34059: fix ajpparsedata message len check - CVE-2026-24072: use APEXPRFLAGRESTRICTED in htaccess - CVE-2026-29169: moddavlock: use the right davlockdiscovery - CVE-2026-33006:...

CVE-2026-8265 Tenda AC6 httpd getLogFile get_log_file os command injection

A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function getlogfile of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit...

CVE-2026-8265 Tenda AC6 httpd getLogFile get_log_file os command injection

A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function getlogfile of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit...

CVE-2026-8264 Tenda AC6 httpd WifiApScan formWifiApScan os command injection

A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is...

CVE-2026-8264 Tenda AC6 httpd WifiApScan formWifiApScan os command injection

A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is...

CVE-2026-8263

The CVE affects Tenda AC6 (firmware 15.03.06.49_multi_TDE01) where the fromSetWirelessRepeat function in /goform/WifiExtraSet within the httpd component is vulnerable. Manipulating the mac/ssid arguments enables an OS command injection, allowing remote exploitation. Public exploits have been rele...

CVE-2026-8263 Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection

A security flaw has been discovered in Tenda AC6 15.03.06.49multiTDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack...