Ubuntu patches multiple Apache HTTP Server vulnerabilities
Key Takeaway
Ubuntu has released security updates for Apache HTTP Server to address vulnerabilities including remote code execution, denial of service, and authentication bypass.
Summary
Ubuntu has issued security notice USN-8931-1 to address several vulnerabilities in the Apache HTTP Server. The fixes cover a range of issues affecting various Ubuntu LTS releases, including potential remote code execution, HTTP response smuggling, and information disclosure via WebDAV and user directories.
Vulnerability details
- CVE-2026-63292: Incorrect handling of certain HTTP requests could allow remote code execution or denial of service.
- CVE-2026-63718: Incorrect interpretation of backend HTTP responses could lead to HTTP response smuggling (affects Ubuntu 20.04, 22.04, 24.04, and 26.04 LTS).
- CVE-2026-73636: Improper validation of Digest authentication requests could allow a machine-in-the-middle attacker to bypass authentication.
- CVE-2026-63045: Improper validation of FTP server responses could allow a forward proxy to connect to an arbitrary host.
- CVE-2026-58415 and CVE-2026-79768: Vulnerabilities in WebDAV and user directory access restrictions could lead to sensitive information disclosure.
Why it matters
Users running Apache HTTP Server on Ubuntu LTS versions should apply these updates immediately to mitigate risks of remote exploitation and data exposure.
Original reference: ubuntu.com →