The Apache httpd project reports:
- limited RCE for some internal redirects to non-CGI files in CGI directories (CVE-2026-42356) [low]
- mod_dav shared lock overflow (CVE-2026-42528) [moderate]
- mod_heartmonitor denial of service (CVE-2026-46729) [low]
- mod_session: Session cookie not removed during internal redirect (CVE-2026-47360) [low]
- mod_auth_digest reauthentication attack (CVE-2026-48005) [low]
- mod_charset_lite: Heap overflow in finish_partial_char (CVE-2026-56153) [low]
- mod_rewrite use-after-free via %{LA-U:HTTP:...} (CVE-2026-56154) [low]
- mod_proxy_html: crash in dump_content (CVE-2026-56449) [low]
- mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVE-2026-57941) [moderate]
- mod_dav_fs property database read access (CVE-2026-58415) [low]
- Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM (CVE-2026-59685) [moderate]
- mod_ssl SSLRequire allows .htaccess ap_expr file-function (CVE-2026-59797) [low]
- mod_proxy_ftp PASV address handling (CVE-2026-63045) [low]
- mod_vhost_alias stack overflow (CVE-2026-63292) [moderate]
- mod_xml2enc crash on charset conversion failure (CVE-2026-63686) [low]
- mod_proxy_uwsgi Transfer-Encoding response smuggling (CVE-2026-63718) [low]
- mod_auth_digest one-time-nonce replay attack (CVE-2026-73636) [low]
- mod_auth_digest DoS attack (CVE-2026-73637) [low]
- mod_userdir information disclosure (CVE-2026-79768) [low]
- mod_dav_fs namespace overflow (CVE-2026-93546) [moderate]