SUSE-SU-2026:5076-1: apache2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:5076-1 is a vulnerability in apache2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 03-11-2026
   PublishedVulnerability first disclosed.
2. 03-11-2026
   Last modifiedVulnerability information updated.

Description

Security update for apache2 This update for apache2 fixes the following issues: - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed (bsc#1284043). - CVE-2026-42528: memory calculation bug in `mod_dav` allows an attacker with permission to create WebDAV locks to crash server child processes (bsc#1284044). - CVE-2026-46729: NULL pointer dereference in `mod_heartmonitor` over unicast listener (bsc#1284045). - CVE-2026-47360: session cookie passed to a backend server when `SessionCookieRemove` changes across internal redirects (bsc#1284046). - CVE-2026-48005: missing authentication checks in `mod_auth_digest` allows an unauthenticated remote client to cause a DoS via forged `Authorization` headers when Digest authentication is enabled with `AuthDigestNcCheck` (bsc#1284047). - CVE-2026-56153: out-of-bounds write in `mod_charset_lite` (bsc#1284048). - CVE-2026-56154: use-after-free in `mod_rewrite` when using lookahead `(%{LA-U:HTTP:...})` (bsc#1284049). - CVE-2026-57941: use-after-free in `mod_http2` via shared `session->bbtmp` re-entrancy (bsc#1284050). - CVE-2026-58415: internal state files accessible to external parties in `mod_dav_fs` allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory (bsc#1284051). - CVE-2026-59797: improper privilege management in `mod_ssl` when using `SSLRequire` and file-related expressions (bsc#1284059). - CVE-2026-63045: improper validation of FTP PASV reply address in `mod_proxy_ftp` allows an untrusted FTP server to cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060). - CVE-2026-63292: stack-based buffer overflow in `mod_vhost_alias` allows a remote client to cause a DoS or potentially execute arbitrary code via an HTTP request with a specially crafted `Host` header (bsc#1284061). - CVE-2026-63686: NULL pointer dereference in `mod_xml2enc` allows an untrusted backend server to cause a denial of service via a crafted proxied response (bsc#1284058). - CVE-2026-63718: inconsistent interpretation of HTTP requests in `mod_proxy_uwsgi` allows for response smuggling via a crafted uwsgi response with `Transfer-Encoding` (bsc#1284057). - CVE-2026-73636: authentication bypass by capture-replay in `mod_auth_digest` allows a MiTM attacker to replay captured digest authentication credentials via crafted requests (bsc#1284056). - CVE-2026-73637: use-after-free in `mod_auth_digest` allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests (bsc#1284055). - CVE-2026-79768: path equivalence issue in the `mod_userdir` module when configured with absolute non-wildcard `UserDir` directive (bsc#1284054). - CVE-2026-93546: integer overflow in `mod_dav_fs` allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database (bsc#1284053).

No weakness data has been published for this record.