Apache HTTP Server 2.4.69 released to fix 20 vulnerabilities

The Apache Software Foundation has released Apache HTTP Server 2.4.69 to address 20 security vulnerabilities. This update is the latest general availability release for the 2.4 series, and administrators are encouraged to update from all previous versions.

The vulnerabilities addressed in this release include five issues rated as moderate severity and 15 rated as low severity. Notable fixes include a use-after-free and memory corruption issue in mod_http2 (CVE-2026-57941), a stack-based buffer overflow in mod_vhost_alias (CVE-2026-63292), and an issue where internal redirects in CGI programs could lead to unintended code execution (CVE-2026-42356).

Other addressed flaws involve out-of-bounds writes on Windows, worker process crashes in mod_dav_fs, response smuggling in mod_proxy_uwsgi, and potential information leaks or denial-of-service risks in various modules including mod_auth_digest and mod_userdir.