Log in Start free

Vulnerability · Published Oct 1, 2026 · Assigned by apache

CVE-2026-42356Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Low 3.7

In plain English

A low-severity security flaw in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 63.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21apache22.4.69-r0ALPINE-CVE-2026-42356
Alpine:v3.22apache22.4.69-r0ALPINE-CVE-2026-42356
Alpine:v3.23apache22.4.69-r0ALPINE-CVE-2026-42356
Alpine:v3.24apache22.4.69-r0ALPINE-CVE-2026-42356
Debian:12apache2no fix listedDEBIAN-CVE-2026-42356
Debian:13apache22.4.69-1~deb13u1DEBIAN-CVE-2026-42356
Debian:14apache22.4.69-1DEBIAN-CVE-2026-42356
Ubuntu:22.04:LTSapache2no fix listedUBUNTU-CVE-2026-42356
Ubuntu:24.04:LTSapache2no fix listedUBUNTU-CVE-2026-42356
Ubuntu:26.04:LTSapache2no fix listedUBUNTU-CVE-2026-42356
Ubuntu:26.10apache2no fix listedUBUNTU-CVE-2026-42356

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache HTTP Server 2.4.60 – through 2.4.68

Weakness: CWE-430 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References