Packages
- apache2 - Apache HTTP server
Details
Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module
incorrectly calculated memory sizes when handling WebDAV locks. An attacker
with permission to create WebDAV locks could possibly use this issue to
cause Apache HTTP Server to crash, resulting in a denial of service.
(CVE-2026-42528)
It was discovered that Apache HTTP Server's mod_vhost_alias module
incorrectly handled certain requests, leading to a one-byte stack buffer
overflow. A remote attacker could possibly use this issue to cause Apache
HTTP Server to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-109163)
It was discovered that Apache HTTP Server's mod_md module incorrectly
handled certain conditions, leading to a NULL pointer dereference. An
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a...
Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module
incorrectly calculated memory sizes when handling WebDAV locks. An attacker
with permission to create WebDAV locks could possibly use this issue to
cause Apache HTTP Server to crash, resulting in a denial of service.
(CVE-2026-42528)
It was discovered that Apache HTTP Server's mod_vhost_alias module
incorrectly handled certain requests, leading to a one-byte stack buffer
overflow. A remote attacker could possibly use this issue to cause Apache
HTTP Server to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-109163)
It was discovered that Apache HTTP Server's mod_md module incorrectly
handled certain conditions, leading to a NULL pointer dereference. An
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu
26.10. (CVE-2026-106023)
It was discovered that Apache HTTP Server's mod_http2 module incorrectly
handled certain request headers, leading to heap corruption. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119618)
Feliks Penconek, Yang Song, and JiaSheng He discovered that Apache HTTP
Server could treat the target of some internal redirects from CGI programs
as a CGI program. A remote attacker could possibly use this issue to
execute arbitrary code. This issue only affected Ubuntu 26.04 LTS and
Ubuntu 26.10. (CVE-2026-42356)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.10 stonking | apache2 – 2.4.68-1ubuntu6.2 | ||
| apache2-bin – 2.4.68-1ubuntu6.2 | |||
| apache2-dev – 2.4.68-1ubuntu6.2 | |||
| 26.04 LTS resolute | apache2 – 2.4.66-2ubuntu2.8 | ||
| apache2-bin – 2.4.66-2ubuntu2.8 | |||
| apache2-dev – 2.4.66-2ubuntu2.8 | |||
| 24.04 LTS noble | apache2 – 2.4.58-1ubuntu8.19 | ||
| apache2-bin – 2.4.58-1ubuntu8.19 | |||
| apache2-dev – 2.4.58-1ubuntu8.19 | |||
| 22.04 LTS jammy | apache2 – 2.4.52-1ubuntu4.27 | ||
| apache2-bin – 2.4.52-1ubuntu4.27 | |||
| apache2-dev – 2.4.52-1ubuntu4.27 | |||
| 20.04 LTS focal | apache2 – 2.4.41-4ubuntu3.23+esm11 | ||
| apache2-bin – 2.4.41-4ubuntu3.23+esm11 | |||
| apache2-dev – 2.4.41-4ubuntu3.23+esm11 | |||
| 18.04 LTS bionic | apache2 – 2.4.29-1ubuntu4.27+esm15 | ||
| apache2-bin – 2.4.29-1ubuntu4.27+esm15 | |||
| apache2-dev – 2.4.29-1ubuntu4.27+esm15 | |||
| 16.04 LTS xenial | apache2 – 2.4.18-2ubuntu3.17+esm24 | ||
| apache2-bin – 2.4.18-2ubuntu3.17+esm24 | |||
| apache2-dev – 2.4.18-2ubuntu3.17+esm24 | |||
| 14.04 LTS trusty | apache2 – 2.4.7-1ubuntu4.22+esm19 | ||
| apache2-bin – 2.4.7-1ubuntu4.22+esm19 | |||
| apache2-dev – 2.4.7-1ubuntu4.22+esm19 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.