CVE-2026-39455: Missing Release of Resource after Effective Lifetime

When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol LDAP authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2026-40435: Unprotected Alternate Channel

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

F5 BIG-IP security vulnerabilities

F5 BIG-IP is an application delivery platform developed by F5 Technologies in the United States. It integrates functions such as network traffic management, application security management, and load balancing. There is a security vulnerability in F5 BIG-IP. This vulnerability arises from the use ...

CVE-2026-33523

A flaw was found in httpd. When processing responses from an untrusted or compromised backend server, multiple modules fail to sanitize Carriage Return and Line Feed CRLF sequences in the HTTP status line. This issue leads to an HTTP response splitting attack. Mitigation To mitigate this issue,...

CVE-2026-29168

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

CVE-2026-29169

A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request. Mitigation Disabling moddavlock and restarting httpd will mitigate this flaw...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0848

Updates of 'httpd' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0848

Updates of 'httpd' packages of Photon OS have been released...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38718)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the formWifiApScan function in the httpd component’s/goform/WifiApScan file, which fails to properly validate the...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38719)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the fromSetWirelessRepeat function in the httpd component’s goform/WifiExtraSet module, which processes parameters...

Critical Photon OS Security Update - PHSA-2026-5.0-0848

Updates of 'httpd', 'gpsd' packages of Photon OS have been released...

Tenda AC6 operating system command injection vulnerability

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the getlogfile function in the httpd component, which processes the wans.flag parameter. Currently, no detailed...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38720)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from an unknown function in the httpd component, specifically the file/goform/telnet, which manipulates the parameter...

CVE-2026-34032

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

CVE-2026-33007

A flaw was found in the modauthnsocache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration. Mitigation Disabling modauthnsocache and restarting...

Exploit for Double Free in Apache Http_Server

CVE-2026-23918 Double-free in Apache httpd modhttp2 stream c...

CLSA-2026-1778490923 httpd: Fix of 9 CVEs

CVE-2026-33857: fix length checks in AJP msgget functions - CVE-2026-34032: fix ajpmsggetstring buffer checks - CVE-2026-34059: fix ajpparsedata message len check - CVE-2026-24072: use APEXPRFLAGRESTRICTED in htaccess - CVE-2026-29169: moddavlock: use the right davlockdiscovery - CVE-2026-33006:...

CVE-2026-8265 Tenda AC6 httpd getLogFile get_log_file os command injection

A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function getlogfile of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit...

CVE-2026-8265 Tenda AC6 httpd getLogFile get_log_file os command injection

A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function getlogfile of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit...

CVE-2026-8264 Tenda AC6 httpd WifiApScan formWifiApScan os command injection

A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the component httpd. Executing a manipulation of the argument wl2g.public.country/wl5g.public.country can lead to os command injection. It is...