81 matches found
OESA-2026-4467 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...
OESA-2026-4365 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...
OESA-2026-4366 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...
OESA-2026-4364 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...
Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2026-3202)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3202 advisory. Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already b...
Important: httpd
Issue Overview: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This...
Important: httpd
Issue Overview: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This...
Amazon Linux 2 : httpd (ALAS-2026-3990)
The version of httpd installed on the remote host is prior to 2.4.69-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3990 advisory. Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI...
AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791538487)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791538487 advisory. - Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to...
BIT-APACHE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
SUSE CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 throu...
httpd: httpd: Information disclosure via session cookie leakage during internal redirects
A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...
CVE-2026-47360
A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...
Linux Distros Unpatched Vulnerability : CVE-2026-47360
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes acros...
Apache 2.4.x < 2.4.69 Multiple Vulnerabilities
The version of Apache httpd installed on the remote host is prior to 2.4.69. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.69 advisory. - Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file- related expressions. This...
CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
ALPINE-CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
AZL-106767 CVE-2026-47360 affecting package httpd 2.4.68-1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
DEBIAN-CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...
CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 throu...