CVE-2026-42536

7.5 highEPSS 1.0%

High (7.5) in apache http server. EPSS 1.0% chance of exploitation in the next 30 days.

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWEs: CWE-122, CWE-120
Published: 2026-06-08
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

Affected

apache:http_server

References

https://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2026/06/08/9
https://access.redhat.com/errata/RHSA-2026:25042
https://access.redhat.com/errata/RHSA-2026:34109
https://access.redhat.com/errata/RHSA-2026:41906

Check your stack JSON