[Urgent] Apache HTTP Server CVE-2026-57941 and 19 More: Fixed in 2.4.69 (CVSS 9.8, Apache Rates It "Moderate") — Update 2.4.68 and Earlier

Apache HTTP Server 2.4.69 came out on 1 October 2026 and fixes 20 vulnerabilities in 2.4.68 and earlier. The CVSS shown in NVD (v3.1, assigned by CISA) is 9.8 for three of them (CVE-2026-57941, CVE-2026-56154, CVE-2026-59797), and 7.0 or higher for 16 of the 20. Yet the Apache security team itself rates the 20 as 5 "moderate" and 15 "low", with nothing "important" or above. JVN (the vulnerability portal of JPCERT/CC and IPA) also posted an update notice on 2 October.

First, what is known and what is not. As of 13 October, when I checked, I found no source saying any of them is being exploited. None of the 20 is in CISA's Known Exploited Vulnerabilities (KEV) catalog, in the copy I fetched on 13 October (dated 8 October). CISA's rating recorded in NVD also says "exploitation: none" for all 20.
But "no exploitation confirmed" does not mean safe. Apache is a staple of public servers and many of the 20 are reachable over the network. It has been 12 days since release, so if you have not updated yet, now is the time.

What to do now

• ✓First, check which version you run. On the server, run `httpd -v`, `apache2 -v` or `apachectl -v`. If it prints 2.4.69, you are done. If it prints 2.4.68 or earlier, go on. (On Windows, the Apache project points to third-party builds, so follow the notice from whoever supplies your build.)
• ✓If you built Apache yourself or use the official release, update to 2.4.69. The download is on the official download page. After updating, stop and start the service again (a service-manager restart such as `systemctl restart`) and run `-v` again to confirm the version. A configuration reload or graceful restart alone may not switch to the new binary (the Apache documentation says the parent process stays alive on a graceful restart).
• ✓If Apache came from your OS package, do not judge by the version number alone. Distributions sometimes take in a fix without raising the version (a backport). As the "Apache from your OS" section below shows, Ubuntu shows CVE-2026-57941 as fixed under older version numbers, while Debian bookworm and trixie were still listed as "vulnerable" on 13 October. Check your own version on your OS's tracker page.
• ✓Apply the update. Install the Apache security update from your package manager if one is available (on Debian-based systems, `apt list --upgradable` shows whether `apache2` is on the list). If none is offered, wait for your OS vendor or move to the official 2.4.69.
• ✓If you cannot update right away, there is no official workaround, so narrow it down by what you use. The Apache announcement gives no workaround for these 20. Items for modules you do not use (WebDAV, mod_proxy_ftp, mod_userdir and so on) often do not apply; see "The 20 fixes" below. (This is our own note, not an official procedure.)

Affected and fixed versions (from the Apache announcement)

• ▸The fixed version is Apache HTTP Server 2.4.69 (released 1 October 2026). The official download page lists it as the current stable release.
• ▸Most items affect 2.4.0 through 2.4.68. Some modules have narrower ranges: CVE-2026-57941 in mod_http2 is 2.4.17 through 2.4.68, CVE-2026-42356 (CGI internal redirects) is 2.4.60 through 2.4.68, CVE-2026-63718 in mod_proxy_uwsgi is 2.4.30 through 2.4.68, and CVE-2026-56449 in mod_proxy_html affects 2.4.68 only.
• ▸One item concerns Windows only. CVE-2026-59685 involves paths with 8.3 short names; Apache's description says "on Windows".
• ▸The official list shows no other fixed release before 2.4.69 for these. The target is 2.4.69.

CVSS 9.8, but Apache says "low" or "moderate"

The 9.8 in the headline is not a score Apache assigned. The CVSS v3.1 shown on the NVD pages comes from "CISA-ADP" for all 20 (CISA's assessment added to NVD), and I found no NIST rating of its own when I fetched them on 13 October. What Apache publishes is not a score but a severity label (low, moderate and so on), and Apache says on its 2.4 vulnerabilities page that the rating "may well vary from platform to platform."

• ▸CVE-2026-57941 (mod_http2): CISA's CVSS is 9.8 (CRITICAL); Apache's rating is "moderate"
• ▸CVE-2026-56154 (mod_rewrite): CISA 9.8; Apache "low". Apache describes a use-after-free when the lookahead `%{LA-U:HTTP:...}` is used
• ▸CVE-2026-59797 (mod_ssl): CISA 9.8; Apache "low". An improper-privilege issue involving SSLRequire and file-related expressions (ap_expr functions usable from .htaccess)

Which one applies depends on your setup. Our reading is that CVSS scores the worst case when conditions line up, while Apache's rating looks closer to how likely the flaw is in ordinary operation (Apache does not explain its rating in detail). Whether the conditions fit you, only your own configuration can tell: whether you use mod_rewrite lookahead, have mod_http2 enabled, or allow .htaccess changes the picture. If in doubt, updating removes all 20 at once.

The 20 fixes, by Apache's own rating

The number in brackets is CISA's CVSS v3.1 as shown in NVD. Conditions are shortened from Apache's descriptions; check each entry in Apache's list for the full conditions.

• ▸[Apache rating: moderate, 5 items]
• ▸CVE-2026-57941 (9.8): use-after-free in mod_http2 (shared buffer re-entrancy). 2.4.17 through 2.4.68
• ▸CVE-2026-59685 (7.5): out-of-bounds write on Windows when processing paths with 8.3 short names
• ▸CVE-2026-63292 (7.5): stack overflow in mod_vhost_alias. With a Host header over 8192 bytes, when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above its default, it can cause denial of service or possibly code execution
• ▸CVE-2026-42528 (4.3): shared-lock overflow in mod_dav. An attacker allowed to create WebDAV locks can crash child processes
• ▸CVE-2026-93546 (8.8): integer overflow in the mod_dav_fs namespace handling. A WebDAV client with write access can crash worker processes and corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces
• ▸[Apache rating: low, 15 items]
• ▸CVE-2026-56154 (9.8): use-after-free in mod_rewrite (`%{LA-U:HTTP:...}`)
• ▸CVE-2026-59797 (9.8): privilege issue in mod_ssl SSLRequire with .htaccess ap_expr file functions
• ▸CVE-2026-73636 (8.1): capture-replay of mod_auth_digest one-time nonces by a man-in-the-middle who sends requests that trigger garbage collection of the client's shared-memory entry, when AuthDigestNonceLifetime is 0
• ▸CVE-2026-73637 (7.3): use-after-free in mod_auth_digest. Concurrent requests corrupt authentication state when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is 0
• ▸CVE-2026-48005 (7.5): forged Authorization headers can force re-authentication in mod_auth_digest (with AuthDigestNcCheck enabled)
• ▸CVE-2026-46729 (7.5): NULL pointer dereference in mod_heartmonitor (unicast listener)
• ▸CVE-2026-47360 (7.5): in mod_session_cookie, when SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend
• ▸CVE-2026-56153 (7.5): heap overflow in mod_charset_lite
• ▸CVE-2026-56449 (7.5): out-of-bounds write in mod_proxy_html with crafted HTTP response bodies (2.4.68 only)
• ▸CVE-2026-58415 (5.3): in mod_dav_fs, someone without authoring rights can GET the .DAV state directory and read WebDAV properties
• ▸CVE-2026-63045 (7.5): mod_proxy_ftp does not validate the PASV reply. In a forward-proxy configuration, an untrusted FTP server can make the proxy open a data connection to a third-party host
• ▸CVE-2026-63686 (7.5): NULL pointer dereference in mod_xml2enc, via an untrusted backend's response whose charset conversion partially succeeds and then fails
• ▸CVE-2026-63718 (7.5): response smuggling via Transfer-Encoding in mod_proxy_uwsgi (2.4.30 onward)
• ▸CVE-2026-79768 (5.3): in mod_userdir, with an absolute, non-wildcard UserDir setting, a "/./" path equivalence leads to information disclosure
• ▸CVE-2026-42356 (3.7): on internal redirects from CGI programs, a file in a CGI-enabled directory with no other extension understood by mod_mime can also be executed as CGI ("limited RCE"; 2.4.60 onward)

Apache from your OS: do not judge by the version number

Your Apache may be fixed even if you never installed 2.4.69. Distributions sometimes carry a fix in a package with an older version number (a backport). What follows is the 13 October result for CVE-2026-57941 only; I did not check the other 19 on the trackers.

• ▸Ubuntu: the tracker lists 26.04 LTS as fixed in 2.4.66-2ubuntu2.5, 24.04 LTS in 2.4.58-1ubuntu8.16, and 22.04 LTS in 2.4.52-1ubuntu4.24 or later. For 20.04 LTS and 18.04 LTS it says the fix comes through Ubuntu Pro (Expanded Security Maintenance). 16.04 and 14.04 are "Not affected".
• ▸Debian: the tracker lists bookworm (2.4.68-1~deb12u1) and trixie (2.4.68-1~deb13u1) as "vulnerable", with "fixed" shown only for 2.4.69-1 (forky and sid). The security-repository packages (bookworm 2.4.67-1~deb12u3, trixie 2.4.67-1~deb13u3) are also listed as "vulnerable".
• ▸How to check: on your OS's tracker, see whether your package version is at or above the "Fixed" version. Even if `apache2 -v` says 2.4.58, if you run Ubuntu 24.04 with the `8.16` build or later, CVE-2026-57941 is fixed.
• ▸I did not check Red Hat-family systems or other OSes. Follow your vendor's notice.

What happened, with dates

• ▸1 October 2026: Apache HTTP Server 2.4.69 was released and the fixes for 20 vulnerabilities were announced. The 20 CVEs also appeared in NVD that day (CISA added its CVSS and SSVC the same day).
• ▸2 October: JVN published "Update for multiple vulnerabilities in Apache HTTP Server 2.4 (1 October 2026)" (JVNVU#94648869), which points readers to the Apache advisory.
• ▸13 October (the day of this check): Debian bookworm and trixie list CVE-2026-57941 as "vulnerable", while Ubuntu lists it as fixed (see above). None of the 20 is in CISA's KEV catalog (copy dated 8 October).

On exploitation: what is known and what is not

What is known. The Apache announcement gives the fixed version and the affected range. It does not say any of them is being exploited. None is in CISA's KEV, and CISA's SSVC rating in NVD says "exploitation: none" for all 20. For CVE-2026-57941, CVE-2026-56154 and CVE-2026-59797 it also records "automatable: yes" and "technical impact: total".

What is not known. Twelve days after release, I cannot find a source on whether exploit code is circulating or whether any attack has happened. Do not treat the absence of an exploitation report as proof of safety.

What I could not confirm

• ▸The configurations in which the three CVSS 9.8 items actually work. The Apache announcement does not detail, for CVE-2026-57941, 56154 and 59797, which settings make them reachable from outside. Check against the modules and settings you actually use.
• ▸NIST's own CVSS rating. The CVSS in NVD was assigned by CISA-ADP. Numbers can change if NIST adds its own.
• ▸Distribution fix status for the other 19. I checked only CVE-2026-57941, on Ubuntu and Debian.
• ▸Indicators of compromise (IoCs). The official sources give no log patterns or file names for detection.
• ▸An official workaround. Apache gives none for these 20. The "conditions" above are our reading of Apache's description text.

The three lines to share

• ▸Apache HTTP Server 2.4.69 (1 October 2026) fixes 20 vulnerabilities. NVD shows CVSS 9.8 for three (CVE-2026-57941, 56154, 59797), but Apache itself rates them 5 "moderate" and 15 "low".
• ▸Update 2.4.68 and earlier to 2.4.69, stop and start the service again, and confirm with `httpd -v`. For Apache from your OS, check your OS tracker, not the version number (Ubuntu has fixed builds; Debian bookworm and trixie were unfixed on 13 October).
• ▸No exploitation is confirmed (not in KEV; CISA rates "exploitation: none"), but that is not "safe". Update public servers soon.