🛡️ USN-8396-1 — apache2 (CVE-2026-24072 +3 more)

apache2 vulnerabilities

It was discovered that the Apache HTTP Server mod_rewrite module

incorrectly handled certain privileges. A local attacker could possibly use

this issue to obtain sensitive information. (CVE-2026-24072)

Andrew Lacambra, Elhanan Haenel, Tianshuo Han, and Tristan Madani

discovered that the Apache HTTP Server mod_proxy_ajp module incorrectly

handled certain AJP server messages. An attacker in control of a

backend AJP server could use this issue to cause Apache HTTP Server to

crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2026-28780)

Pavel Kohout discovered that the Apache HTTP Server incorrectly handled

certain memory operations in mod_dav_lock. A remote attacker could possibly

use this issue to cause Apache HTTP Server to crash, resulting in a denial

of service. (CVE-2026-29169)

Elhanan Haenel discovered that Apache HTTP Server incorrectly handled

certain memory operations in mod_proxy_ajp. A remote attacker could use

this issue to cause Apache HTTP Server to crash, resulting in a denial of

service, or possibly obtain sensitive information. (CVE-2026-34059)