CVE-2026-43951
published 2026-06-08CVE-2026-43951: Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.55%
42.5th percentile
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 2.4.0 – 2.4.67 | — |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.67 | — |
| ubuntu | apache2 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_ubuntu9.8CRITICAL
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 5.3
CVE-2026-34032 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server
incorrectly handled certain memory operations in mod_authn_socache. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2026-33007)
Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apache
HTTP Server had an HTTP response splitting vulnerability in multiple
modules when used with untrusted or compromised backend servers. An
attacker could possibly use this issue to inject arbitrary HTTP headers.
(CVE-2026-33523)
Elhanan Haenel discovered that Apache HTTP Server incorrectly handled
certain memory operations in mod_proxy_ajp. A remote attacker could
possibly use this i
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2026-07-08·CVSS 9.8
CVE-2026-44119 [CRITICAL] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
It was discovered that Apache HTTP Server's mod_ldap module incorrectly
handled memory when processing per-directory configurations. An attacker
could use this issue to cause the server to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-29167)
It was discovered that Apache HTTP Server's mod_proxy_ftp module
incorrectly handled HTML generation for FTP directory listings. A remote
attacker could possibly use this issue to inject arbitrary web script or
HTML. (CVE-2026-29170)
It was discovered that Apache HTTP Server's mod_proxy_html module
incorrectly handled certain content from an untrusted backend. A remote
attacker could possibly use this
Red Hat
httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime
vendor_redhat·2026-06-08·CVSS 6.5
CVE-2026-43951 [MEDIUM] CWE-125 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime
httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when `mod_headers` and `mod_mime` are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service.
Statement: This Moderate impact vulnerability in Apache HTTP Server arises from an out-of-bounds read when both `mod_headers` and `mod_mime` modules are active and configured for multiple response languages. While this configuration is not universally enabled by defau
VulDB
Apache HTTP Server up to 2.4.67 merge_response_headers out-of-bounds (EUVD-2026-35093 / Nessus ID 319665)
vuldb·2026-06-08·CVSS 6.5
CVE-2026-43951 [MEDIUM] Apache HTTP Server up to 2.4.67 merge_response_headers out-of-bounds (EUVD-2026-35093 / Nessus ID 319665)
A vulnerability identified as problematic has been detected in Apache HTTP Server up to 2.4.67. Affected is the function merge_response_headers. The manipulation leads to out-of-bounds read.
This vulnerability is listed as CVE-2026-43951. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
GHSA
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
ghsa_unreviewed·2026-06-08
CVE-2026-43951 [MEDIUM] CWE-125 Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-43951 mod_http2: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime [fedora-all]
bugzilla·2026-07-01·CVSS 6.5
CVE-2026-43951 [MEDIUM] CVE-2026-43951 mod_http2: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime [fedora-all]
CVE-2026-43951 mod_http2: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Bugzilla
CVE-2026-43951 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime [fedora-all]
bugzilla·2026-06-18·CVSS 6.5
CVE-2026-43951 [MEDIUM] CVE-2026-43951 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime [fedora-all]
CVE-2026-43951 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-43951 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime
bugzilla·2026-06-08·CVSS 6.5
CVE-2026-43951 [MEDIUM] CVE-2026-43951 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime
CVE-2026-43951 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
2026-06-08
Published