PT-2026-97428

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.38.0-3.1 Description The httpd component of BusyBox incorrectly processes yescrypt $y$ password hashes during Basic Authentication. Instead of verifying the hash, the system treats it as plaintext, which inverts the...

PT-2026-105035

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-88837: Authentication Bypass by Primary Weakness

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

Security Bulletin: Vulnarabilities in kernel, glibc, expat, RMC daemon, httpd and mod_http2 libraries (CVE-2026-46333, CVE-2026-4046, CVE-2026-45186, CVE-2026-14514, CVE-2025-53020, CVE-2026-49975) affect Power HMC.

Summary The kernel, glibc, expat, RMC daemon, httpd and modhttp2 libraries are used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash d...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003826)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003826 advisory. If LimitXMLRequestBody is set to allow request bodies larger than 350MB defaults to 1M on 32 bit systems an integer overflow happens which later causes out of bounds...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090460 advisory. In Apache HTTP Server 2.4.0 to 2.4.41, modproxyftp may use uninitialized memory when proxying to a malicious FTP server. Tenable has extracted the preceding...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003827 advisory. Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090073 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE Tenable has extracted the preceding description block directly from the Unity Linu...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090049)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090049 advisory. HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with H2PushResource, could lead to an overwrite of memory in the pushing request's pool, leadi...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-000273)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000273 advisory. Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the...

CVE-2026-66835

A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...

EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2026-3869)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : locking/rtmutex: Skip removewaiter when waiter is not enqueuedCVE-2026-53163 ppp: require CAPNETADMIN in target netns for unattached...

EulerOS Virtualization 2.11.1 : httpd (EulerOS-SA-2026-3422)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

EulerOS Virtualization 2.11.0 : httpd (EulerOS-SA-2026-3509)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

Tenda F451 httpd DoS

The vulnerability of the fromGstDhcpSetSer function /goform/GstDhcpSetSer in the httpd microprogramming system for Tenda F451 components is related to the issue of the operation going beyond the buffer in memory when processing the dips parameter. Exploiting this vulnerability could allow an...

EulerOS Virtualization 2.12.1 : httpd (EulerOS-SA-2026-3589)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.This issue affects Apache HTTP Server: through...

CVE-2026-70399

A flaw was found in inets. An unauthenticated remote attacker can exploit a resource allocation vulnerability in the Erlang/OTP inets httpd component. This flaw allows the attacker to cause a denial of service by opening and holding open a large number of connections. The server fails to enforce...

EulerOS 2.0 SP15 : httpd (EulerOS-SA-2026-3806)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A buffer overflow in modproxyhtml in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.x000D Users are recommended to...

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the ajpparsedata function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially lea...

httpd: NULL pointer dereference via specially crafted request

A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request...