# Apache software security vulnerability updates

> Live situation record from CLSTR: https://clstr.news/situations/apache-software-security-vulnerability-updates
> Updated: 2026-10-03T14:23:14.000Z. Sources: 5. Developments: 2.

The Apache Software Foundation has issued security updates for multiple software products to address various vulnerabilities.

In late September, Apache Tomcat 11.0.26 was released to resolve flaws affecting WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. Specific issues included a WebSocket message smuggling flaw (CVE-2026-87022) and an HTTP/2 regression (CVE-2026-86350), alongside several denial-of-service risks.

Following this, the Apache HTTP Server 2.4.69 was released to patch 20 vulnerabilities. These included five moderate-severity and 15 low-severity issues, such as a use-after-free and memory corruption issue in mod_http2 (CVE-2026-57941), a stack-based buffer overflow in mod_vhost_alias (CVE-2026-63292), and potential code execution via CGI internal redirects (CVE-2026-42356).

## Timeline

### 2026-10-03: Apache HTTP Server 2.4.69 released to fix 20 vulnerabilities

Apache Software Foundation released HTTP Server 2.4.69 to fix 20 vulnerabilities, including moderate-severity memory issues and buffer overflows in various modules.

2 sources. https://clstr.news/cluster/apache-http-server-2469-released-to-fix-20-vulnerabilities

### 2026-09-24: Apache Tomcat releases update to fix WebSocket and HTTP/2 security flaws

Apache Software Foundation released Tomcat 11.0.26 to fix numerous security vulnerabilities, including WebSocket message smuggling and HTTP/2 header mix-ups.

3 sources. https://clstr.news/cluster/apache-tomcat-releases-update-to-fix-websocket-and-http2-security-flaws

---
Cite as: Apache software security vulnerability updates. CLSTR, https://clstr.news/situations/apache-software-security-vulnerability-updates