CVE-2026-47360
published 2026-10-01CVE-2026-47360: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.39%
31.5th percentile
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.60 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
ghsa_unreviewed·2026-10-01
CVE-2026-47360 [HIGH] CWE-200 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Red Hat
httpd: httpd: Information disclosure via session cookie leakage during internal redirects
vendor_redhat·2026-10-01·CVSS 7.5
CVE-2026-47360 [HIGH] CWE-212 httpd: httpd: Information disclosure via session cookie leakage during internal redirects
httpd: httpd: Information disclosure via session cookie leakage during internal redirects
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
A flaw was found in Apache HTTP Server's mod_session_cookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session tokens to backend servers.
Mitigation: If cookie-based session management is not required, disable th
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47360 httpd: httpd: Information disclosure via session cookie leakage during internal redirects [fedora-all]
bugzilla·2026-10-02·CVSS 7.5
CVE-2026-47360 [HIGH] CVE-2026-47360 httpd: httpd: Information disclosure via session cookie leakage during internal redirects [fedora-all]
CVE-2026-47360 httpd: httpd: Information disclosure via session cookie leakage during internal redirects [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Bugzilla
CVE-2026-47360 httpd: httpd: Information disclosure via session cookie leakage during internal redirects
bugzilla·2026-10-01·CVSS 7.5
CVE-2026-47360 [HIGH] CVE-2026-47360 httpd: httpd: Information disclosure via session cookie leakage during internal redirects
CVE-2026-47360 httpd: httpd: Information disclosure via session cookie leakage during internal redirects
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
2026-10-01
Published