Veille CVE

Lundi 4 mai 2026

4 CVE sur 9

Critique 0 Élevée 4 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « apache http_server » ✕
  1. CVE-2026-29169 7.5 Élevée

    Apache Software Foundation Apache HTTP Server · Apache http server

    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.

  2. CVE-2026-23918 8.8 Élevée

    Apache Software Foundation Apache HTTP Server · Red Hat Hardened Images · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6

    Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  3. CVE-2026-34059 7.5 Élevée

    Apache Software Foundation Apache HTTP Server · Apache http server

    Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  4. CVE-2026-24072 8.8 Élevée

    Apache Software Foundation Apache HTTP Server · Apache http server

    An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.