Veille CVE

Lundi 14 septembre 2026

4 CVE

Critique 1 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Apache Software Foundation Apache HTTP Server » ✕
  1. CVE-2026-44185 7.3 Élevée

    Apache Software Foundation Apache HTTP Server · Red Hat JBoss Core Services for RHEL 8 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

  2. CVE-2026-42536 7.5 Élevée

    Apache Software Foundation Apache HTTP Server · Red Hat JBoss Core Services for RHEL 8 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

  3. CVE-2026-34355 7.5 Élevée

    Apache Software Foundation Apache HTTP Server · Red Hat JBoss Core Services for RHEL 8 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

  4. CVE-2026-28780 9.8 Critique

    Apache Software Foundation Apache HTTP Server · Red Hat JBoss Core Services for RHEL 8 · Red Hat JBoss Core Services on RHEL 7 · Red Hat Enterprise Linux 10

    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.