CVE-2026-63686
published 2026-10-01CVE-2026-63686: A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.48%
39.4th percentile
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc
vendor_redhat·2026-10-01·CVSS 7.5
CVE-2026-63686 [HIGH] CWE-476 httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc
httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in the mod_xml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service (DoS) by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access (null pointer dereference), causing the server process to crash.
Mitigati
VulDB
Apache HTTP Server up to 2.4.68 mod_xml2enc null pointer dereference (Nessus ID 364495 / WID-SEC-2026-3703)
vuldb·2026-10-10·CVSS 7.5
CVE-2026-63686 [HIGH] Apache HTTP Server up to 2.4.68 mod_xml2enc null pointer dereference (Nessus ID 364495 / WID-SEC-2026-3703)
A vulnerability classified as problematic has been found in Apache HTTP Server up to 2.4.68. This affects an unknown part of the component mod_xml2enc. The manipulation leads to null pointer dereference.
This vulnerability is listed as CVE-2026-63686. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied
ghsa_unreviewed·2026-10-01
CVE-2026-63686 [HIGH] CWE-476 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-63686 httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc [fedora-all]
bugzilla·2026-10-02·CVSS 7.5
CVE-2026-63686 [HIGH] CVE-2026-63686 httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc [fedora-all]
CVE-2026-63686 httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Bugzilla
CVE-2026-63686 httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc
bugzilla·2026-10-01·CVSS 7.5
CVE-2026-63686 [HIGH] CVE-2026-63686 httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc
CVE-2026-63686 httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
2026-10-01
Published