{"schemaVersion":3,"id":"OPENSUSE-SU-2026:21115-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for apache2\n\nThis update for apache2 fixes the following issues\n\n- CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).\n- CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).\n- CVE-2026-28780: heap buffer overflow in `mod_proxy_ajp` via `ajp_msg_check_header()` (bsc#1264163).\n- CVE-2026-29168: allocation of resources without limits in `mod_md` via OCSP response (bsc#1264150).\n- CVE-2026-29169: NULL pointer dereference in `mod_dav_lock` allows server crash via malicious requests (bsc#1263956).\n- CVE-2026-33006: `mod_auth_digest` timing attack allows bypass of Digest authentication (bsc#1263955).\n- CVE-2026-33007: NULL pointer dereference in `mod_authn_socache` allows unauthenticated remote user to crash a child\n  processes (bsc#1263954).\n- CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).\n- CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).\n- CVE-2026-34032: heap buffer overread in `mod_proxy_ajp` due to missing null-termination check (bsc#1263951).\n- CVE-2026-34059: heap buffer overread and memory disclosure via `ajp_parse_data()` (bsc#1263950).","dates":{"published":"2026-06-20T06:56:29.000Z","modified":"2026-06-30T18:24:42.659Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"apache2-devel&distro=openSUSE Leap 16.0","name":"apache2-devel","label":"apache2-devel&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2-devel&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.66-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.66-160000.2.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apache2-event&distro=openSUSE Leap 16.0","name":"apache2-event","label":"apache2-event&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2-event&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.66-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.66-160000.2.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apache2-manual&distro=openSUSE Leap 16.0","name":"apache2-manual","label":"apache2-manual&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2-manual&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.66-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.66-160000.2.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apache2-prefork&distro=openSUSE Leap 16.0","name":"apache2-prefork","label":"apache2-prefork&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2-prefork&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.66-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.66-160000.2.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apache2-utils&distro=openSUSE Leap 16.0","name":"apache2-utils","label":"apache2-utils&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2-utils&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.66-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.66-160000.2.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apache2-worker&distro=openSUSE Leap 16.0","name":"apache2-worker","label":"apache2-worker&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2-worker&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.66-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.66-160000.2.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apache2&distro=openSUSE Leap 16.0","name":"apache2","label":"apache2&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.66-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.66-160000.2.1","eol":null,"hubHref":null}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.suse.com/1263935","label":"bugzilla.suse.com/1263935","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263950","label":"bugzilla.suse.com/1263950","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263951","label":"bugzilla.suse.com/1263951","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263952","label":"bugzilla.suse.com/1263952","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263953","label":"bugzilla.suse.com/1263953","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263954","label":"bugzilla.suse.com/1263954","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263955","label":"bugzilla.suse.com/1263955","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263956","label":"bugzilla.suse.com/1263956","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1263957","label":"bugzilla.suse.com/1263957","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1264150","label":"bugzilla.suse.com/1264150","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1264163","label":"bugzilla.suse.com/1264163","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23918","label":"www.suse.com/security/cve/CVE-2026-23918","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24072","label":"www.suse.com/security/cve/CVE-2026-24072","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28780","label":"www.suse.com/security/cve/CVE-2026-28780","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29168","label":"www.suse.com/security/cve/CVE-2026-29168","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29169","label":"www.suse.com/security/cve/CVE-2026-29169","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33006","label":"www.suse.com/security/cve/CVE-2026-33006","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33007","label":"www.suse.com/security/cve/CVE-2026-33007","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33523","label":"www.suse.com/security/cve/CVE-2026-33523","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33857","label":"www.suse.com/security/cve/CVE-2026-33857","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34032","label":"www.suse.com/security/cve/CVE-2026-34032","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34059","label":"www.suse.com/security/cve/CVE-2026-34059","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-23918","CVE-2026-24072","CVE-2026-28780","CVE-2026-29168","CVE-2026-29169","CVE-2026-33006","CVE-2026-33007","CVE-2026-33523","CVE-2026-33857","CVE-2026-34032","CVE-2026-34059"],"downstream":[],"duplicates":[],"related":["CVE-2026-23918","CVE-2026-24072","CVE-2026-28780","CVE-2026-29168","CVE-2026-29169","CVE-2026-33006","CVE-2026-33007","CVE-2026-33523","CVE-2026-33857","CVE-2026-34032","CVE-2026-34059"]},"timeline":[{"kind":"published","date":"2026-06-20T06:56:29.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-30T18:24:42.659Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T06:56:41.036Z","stale":false,"partial":false}}