--- id: CVE-2026-42536 title: "Heap-based Buffer Overflow vulnerability in Apache HTTP Server with\_mod_xml2enc, xml2StartParse, and untrusted content\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68…" summary: "Heap-based Buffer Overflow vulnerability in Apache HTTP Server with\_mod_xml2enc, xml2StartParse, and untrusted content\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68…" severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-122 - CWE-120 vendor: apache product: http_server affected: - 'http_server >= 2.4.0, < 2.4.68' patched: - http_server 2.4.68 published: '2026-06-08' updated: '2026-09-14' sourceUpdated: '2026-09-14T13:18:36.300' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42536' references: - url: 'https://httpd.apache.org/security/vulnerabilities_24.html' label: security@apache.org - url: 'http://www.openwall.com/lists/oss-security/2026/06/08/9' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2026:25042' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34109' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41906' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42828' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:47046' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:53371' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:56868' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:56869' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:62165' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:66323' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:67152' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-42536' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2486411' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42536.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42536' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42536' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-06-08T18:09:39.478431Z' epss: 0.02686 epssPercentile: 0.85223 exploits: github: 1 githubRepos: - 'https://github.com/erberkan/CVE-2026-42536-PoC' checkedAt: '2026-09-25T08:20:56.979Z' exploitAvailable: true ingestedAt: '2026-07-16T12:53:56.307Z' --- ## Overview Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue. ## Affected - `http_server >= 2.4.0, < 2.4.68` ## Remediation Upgrade past the affected range: - `http_server 2.4.68` ## Vendor advisories - **RHSA-2026:56868** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 8 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56868) - **RHSA-2026:47046** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47046) - **RHSA-2026:34109** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34109) - **RHSA-2026:42828** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42828) - **RHSA-2026:66323** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66323) - **RHSA-2026:62165** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62165) - **RHSA-2026:41906** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41906) - **RHSA-2026:25042** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:25042) - **RHSA-2026:53371** · Red Hat · fixed in: Red Hat Insights proxy 1.5 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53371) - **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42536.json) - **RHSA-2026:67152** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67152)