httpd security update

{
  "id": "9979c267c3f8423def2da84c751dfa68727b910973748c423190cb6fdae84ec1",
  "url": "https://osv.dev/vulnerability/OESA-2026-4365",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "httpd security update",
    "summary": "Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue(CVE-2026-42528) NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-46729) Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-47360) Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56153) Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-56154) Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-57941)",
    "evidence": "osv:OESA-2026-4365",
    "products": [
      {
        "name": {
          "value": "httpd",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.4.58-22.oe2403sp4",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "OESA-2026-4365",
      "aliases": [
        "OESA-2026-4365"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.4.58-22.oe2403sp4"
                }
              ]
            }
          ],
          "package": {
            "name": "httpd",
            "purl": "pkg:rpm/openEuler/httpd&distro=openEuler-24.03-LTS-SP4",
            "ecosystem": "openEuler:24.03-LTS-SP4"
          },
          "database_specific": {
            "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4365.json"
          },
          "ecosystem_specific": {
            "src": [
              "httpd-2.4.58-22.oe2403sp4.src.rpm"
            ],
            "noarch": [
              "httpd-filesystem-2.4.58-22.oe2403sp4.noarch.rpm",
              "httpd-help-2.4.58-22.oe2403sp4.noarch.rpm"
            ],
            "x86_64": [
              "httpd-2.4.58-22.oe2403sp4.x86_64.rpm",
              "httpd-debuginfo-2.4.58-22.oe2403sp4.x86_64.rpm",
              "httpd-debugsource-2.4.58-22.oe2403sp4.x86_64.rpm",
              "httpd-devel-2.4.58-22.oe2403sp4.x86_64.rpm",
              "httpd-tools-2.4.58-22.oe2403sp4.x86_64.rpm",
              "mod_ldap-2.4.58-22.oe2403sp4.x86_64.rpm",
              "mod_md-2.4.58-22.oe2403sp4.x86_64.rpm",
              "mod_proxy_html-2.4.58-22.oe2403sp4.x86_64.rpm",
              "mod_session-2.4.58-22.oe2403sp4.x86_64.rpm",
              "mod_ssl-2.4.58-22.oe2403sp4.x86_64.rpm"
            ],
            "aarch64": [
              "httpd-2.4.58-22.oe2403sp4.aarch64.rpm",
              "httpd-debuginfo-2.4.58-22.oe2403sp4.aarch64.rpm",
              "httpd-debugsource-2.4.58-22.oe2403sp4.aarch64.rpm",
              "httpd-devel-2.4.58-22.oe2403sp4.aarch64.rpm",
              "httpd-tools-2.4.58-22.oe2403sp4.aarch64.rpm",
              "mod_ldap-2.4.58-22.oe2403sp4.aarch64.rpm",
              "mod_md-2.4.58-22.oe2403sp4.aarch64.rpm",
              "mod_proxy_html-2.4.58-22.oe2403sp4.aarch64.rpm",
              "mod_session-2.4.58-22.oe2403sp4.aarch64.rpm",
              "mod_ssl-2.4.58-22.oe2403sp4.aarch64.rpm"
            ]
          }
        }
      ],
      "modified": "2026-10-16T12:15:10.277889751Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-42528",
        "CVE-2026-46729",
        "CVE-2026-47360",
        "CVE-2026-56153",
        "CVE-2026-56154",
        "CVE-2026-57941"
      ],
      "references": [
        "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4365",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-42528",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-46729",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-47360",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-56153",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-56154",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-57941"
      ],
      "provider_metadata": {
        "severity": "Critical"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-42528",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-46729",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-47360",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56153",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56154",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-57941",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 340811,
  "published_at": "2026-10-16T11:59:49+00:00"
}