FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Apache httpd -- Multiple vulnerabilities

Affected packages
		apache24	<	2.4.71

Details

VuXML ID	f2904526-ddd3-11f1-8135-8447094a420f
Discovery	2026-11-11
Entry	2026-11-11

The Apache httpd project reports:

CVE-2026-119618 (critical): mod_http2: heap corruption and RCE in assign_headers

CVE-2026-106023 (important): mod_md NULL pointer dereference leads to child process crash

CVE-2026-109163 (low): mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

[source]

References

CVE Name	CVE-2026-106023
CVE Name	CVE-2026-109163
CVE Name	CVE-2026-119618
URL	https://httpd.apache.org/security/vulnerabilities_24.html