[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

2 clusters · 5 sources · 10 days · First seen · Last updated

Apache software security vulnerability updates

Overview

The Apache Software Foundation has issued security updates for multiple software products to address various vulnerabilities.

In late September, Apache Tomcat 11.0.26 was released to resolve flaws affecting WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. Specific issues included a WebSocket message smuggling flaw (CVE-2026-87022) and an HTTP/2 regression (CVE-2026-86350), alongside several denial-of-service risks.

Following this, the Apache HTTP Server 2.4.69 was released to patch 20 vulnerabilities. These included five moderate-severity and 15 low-severity issues, such as a use-after-free and memory corruption issue in mod_http2 (CVE-2026-57941), a stack-based buffer overflow in mod_vhost_alias (CVE-2026-63292), and potential code execution via CGI internal redirects (CVE-2026-42356).

Entities

Apache Software Foundation · Apache HTTP Server · Apache Tomcat

Timeline

  1. [TECHNOLOGY] 2 sources
    Apache HTTP Server 2.4.69 released to fix 20 vulnerabilities

    Apache Software Foundation released HTTP Server 2.4.69 to fix 20 vulnerabilities, including moderate-severity memory issues and buffer overflows in various modules.

  2. [TECHNOLOGY] 3 sources
    Apache Tomcat releases update to fix WebSocket and HTTP/2 security flaws

    Apache Software Foundation released Tomcat 11.0.26 to fix numerous security vulnerabilities, including WebSocket message smuggling and HTTP/2 header mix-ups.

Sources

cybernoz.com · jvn.jp · linuxsecurity.com · thecyberexpress.com · thinkit.co.jp