{"schemaVersion":3,"id":"MGASA-2026-0289","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated apache packages fix security vulnerabilities\n\nThe updated packages fix security vulnerabilities:\nApache HTTP Server: mod_ldap per-dir use-after-free. (CVE-2026-29167)\nApache HTTP Server: mod_proxy_ftp XSS. (CVE-2026-29170)\nApache HTTP Server: mod_proxy_html buffer overflow. (CVE-2026-34355)\nApache HTTP Server: ProxyPassReverseCookieMap buffer overflow.\n(CVE-2026-34356)\nApache HTTP Server: mod_dav_fs protected directory access.\n(CVE-2026-42535)\nApache HTTP Server: mod_xml2enc heap overflow. (CVE-2026-42536)\nApache HTTP Server: OOB Read in `merge_response_headers` can cause\ncrash. (CVE-2026-43951)\nApache HTTP Server: escalation of privilege through expressions in\n.htaccess in multiple modules. (CVE-2026-44119)\nApache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP\n`send_request`. (CVE-2026-44185)\nApache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp.\n(CVE-2026-44186)\nApache HTTP Server: Heap Underflow in `ap_regname` via Signed Char\nOverflow. (CVE-2026-44631)\nApache HTTP Server: mod_http2 memory corruption when file handles\nexhausted. (CVE-2026-48913)\nApache HTTP Server: mod_http2 denial of service. (CVE-2026-49975)","dates":{"published":"2026-07-23T17:45:56.000Z","modified":"2026-07-23T18:00:05.384Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"apache","name":"apache","label":"apache","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/apache","purlType":"rpm","versions":[{"text":"< 2.4.68-1.mga10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.68-1.mga10","eol":null,"hubHref":null},{"vendor":"mageia","product":"apache","name":"apache","label":"apache","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/apache","purlType":"rpm","versions":[{"text":"< 2.4.68-1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.68-1.mga9","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0289.html","label":"advisories.mageia.org/MGASA-2026-0289.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35625","label":"bugs.mageia.org/show_bug.cgi?id=35625","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/03/3","label":"www.openwall.com/lists/oss-security/2026/06/03/3","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb","label":"blog.calif.io/p/codex-discovered-a-hidden-http2-bomb","hostname":"blog.calif.io","tags":["WEB"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00234.html","label":"lists.debian.org/debian-security-announce/2026/msg00234.html","hostname":"lists.debian.org","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/4","label":"www.openwall.com/lists/oss-security/2026/06/08/4","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/5","label":"www.openwall.com/lists/oss-security/2026/06/08/5","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/6","label":"www.openwall.com/lists/oss-security/2026/06/08/6","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/7","label":"www.openwall.com/lists/oss-security/2026/06/08/7","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/8","label":"www.openwall.com/lists/oss-security/2026/06/08/8","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/9","label":"www.openwall.com/lists/oss-security/2026/06/08/9","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/10","label":"www.openwall.com/lists/oss-security/2026/06/08/10","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/11","label":"www.openwall.com/lists/oss-security/2026/06/08/11","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/12","label":"www.openwall.com/lists/oss-security/2026/06/08/12","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/13","label":"www.openwall.com/lists/oss-security/2026/06/08/13","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/14","label":"www.openwall.com/lists/oss-security/2026/06/08/14","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/15","label":"www.openwall.com/lists/oss-security/2026/06/08/15","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/16","label":"www.openwall.com/lists/oss-security/2026/06/08/16","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R2KWQ6IEDZQHPWK66QN6DG4LW6X3OUM/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-29167","CVE-2026-29170","CVE-2026-34355","CVE-2026-34356","CVE-2026-42535","CVE-2026-42536","CVE-2026-43951","CVE-2026-44119","CVE-2026-44185","CVE-2026-44186","CVE-2026-44631","CVE-2026-48913","CVE-2026-49975"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-07-23T17:45:56.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-23T18:00:05.384Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:06:12.344Z","stale":false,"partial":false}}