CVE-2026-56153
published 2026-10-01CVE-2026-56153: Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.50%
41.8th percentile
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite
vendor_redhat·2026-10-01·CVSS 7.5
CVE-2026-56153 [HIGH] CWE-787 httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite
httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
A flaw was found in httpd's mod_charset_lite module. A heap-based buffer overflow (an out-of-bounds memory write) occurs in the finish_partial_char function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory corruption. This issue primarily results in a Denial of Service (DoS) condition by crashing the server process.
Mitigation: Disable the mod_charset_lite module if character set translation is not required.
1. Locate the configuration file loading the module, typically within `
GHSA
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
ghsa_unreviewed·2026-10-01
CVE-2026-56153 [HIGH] CWE-787 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56153 httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite [fedora-all]
bugzilla·2026-10-02·CVSS 7.5
CVE-2026-56153 [HIGH] CVE-2026-56153 httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite [fedora-all]
CVE-2026-56153 httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Bugzilla
CVE-2026-56153 httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite
bugzilla·2026-10-01·CVSS 7.5
CVE-2026-56153 [HIGH] CVE-2026-56153 httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite
CVE-2026-56153 httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
2026-10-01
Published