Apache security advisories, October 2026

Every Apache Software Foundation security advisory published in October 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 348
Critical: 34
High: 125
In CISA KEV: 0

Apache advisories published in October 2026

Oct 2, 2026
High [CVE-2026-93926] Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport
High8.7
Oct 2, 2026
High [CVE-2026-94633] Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings
High8.7
Oct 2, 2026
High [CVE-2026-94634] Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings
High8.2
Oct 2, 2026
High [CVE-2026-61373 +1] Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
High8.2
Oct 2, 2026
High [CVE-2026-94635] Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings
High8.7
Oct 2, 2026
Medium [CVE-2026-66054] Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings
Medium6.9
Oct 2, 2026
Medium [CVE-2026-66331] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport
Medium6.9
Oct 2, 2026
Medium [CVE-2026-94652] Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings
Medium6.3
Oct 2, 2026
Medium [CVE-2026-92834] Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server
Medium6.3
Oct 2, 2026
Medium [CVE-2026-86536] Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings
Medium6.3
Oct 2, 2026
Medium [CVE-2026-85088] Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift
Medium6.9
Oct 2, 2026
Medium [CVE-2026-85087] Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings
Medium6.9
Oct 2, 2026
Medium [CVE-2026-85086] Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings
Medium6.9
Oct 2, 2026
Medium [CVE-2026-85483] Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings
Medium6.3
Oct 2, 2026
Advisory [CVE-2026-103885] Apache Directory LDAP API: Denial of service via crafted telephone number values
Unrated
Oct 2, 2026
Advisory [CVE-2026-103877] Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
Unrated
Oct 2, 2026
Advisory [CVE-2026-103880] Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords
Unrated
Oct 2, 2026
Advisory [CVE-2026-103878] Apache Directory LDAP API: Injection of plaintext responses during StartTLS
Unrated
Oct 2, 2026
Advisory [CVE-2026-103552] Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder
Unrated
Oct 2, 2026
Advisory [CVE-2026-102731] Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode
Unrated
Oct 1, 2026
Critical [CVE-2026-59797] Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions
Critical9.8
Oct 1, 2026
Critical [CVE-2026-57941] Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68
Critical9.8
Oct 1, 2026
Critical [CVE-2026-56154] Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68
Critical9.8
Oct 1, 2026
High [CVE-2026-63686] NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails
High7.5
Oct 1, 2026
High [CVE-2026-93546] Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces
High8.8
Oct 1, 2026
High [CVE-2026-73637] Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0
High7.3
Oct 1, 2026
High [CVE-2026-73636] Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0
High8.1
Oct 1, 2026
High [CVE-2026-63718] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding
High7.5
Oct 1, 2026
High [CVE-2026-63292] Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default
High7.5
Oct 1, 2026
High [CVE-2026-63045] Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response
High7.5
Oct 1, 2026
High [CVE-2026-59685] Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded
High7.5
Oct 1, 2026
High [CVE-2026-56449] Apache HTTP Server: mod_proxy_html: crash in dump_content
High7.5
Oct 1, 2026
High [CVE-2026-56153] Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite
High7.5
Oct 1, 2026
High [CVE-2026-48005] Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck
High7.5
Oct 1, 2026
High [CVE-2026-47360] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module
High7.5
Oct 1, 2026
High [CVE-2026-46729] NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener
High7.5
Oct 1, 2026
High [CVE-2026-94250] Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX
High8.2
Oct 1, 2026
High [CVE-2026-88789] Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or issue requests to internal network locations via an external entity declaration in that document
High8.6
Oct 1, 2026
Medium [CVE-2026-79768] Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68
Medium5.3
Oct 1, 2026
Medium [CVE-2026-58415] Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the.DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68
Medium5.3
Oct 1, 2026
Medium [CVE-2026-42528] memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes
Medium4.3
Oct 1, 2026
Medium [CVE-2026-94276] Improper Authentication vulnerability in Apache APISIX
Medium5.1
Oct 1, 2026
Medium [CVE-2026-94269] Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX
Medium6.3
Oct 1, 2026
Medium [CVE-2026-94212] Improper verification of cryptographic signature vulnerability in Apache APISIX
Medium6.4
Oct 1, 2026
Medium [CVE-2026-82806] Exposure of data element to wrong session vulnerability in Apache APISIX
Medium5.3
Oct 1, 2026
Medium [CVE-2026-78242] Insertion of sensitive information into log file vulnerability in Apache APISIX
Medium5.7
Oct 1, 2026
Low [CVE-2026-42356] Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed
Low3.7
Oct 1, 2026
Low [CVE-2026-94220] Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX
Low2.1

Page 4 of 4 · 48 of 348

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.