Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-42356: Apache HTTP Server may run unintended scripts via redirect
CVE-2026-42356 · published 17 days ago
Summary
Apache HTTP Server versions 2.4.60 through 2.4.68 can treat files that are redirected by certain CGI programs as executable scripts, even when they were not meant to run. This could allow an attacker to cause the server to execute unwanted code. Upgrade the server to a newer release (2.4.69 or later) or apply the vendor’s security patch and review your CGI settings to limit what can be executed.
What to do
- Update alpine apache2 to version 2.4.69-r0.
- Update bellsoft apache2 to version 2.4.69-r0.
- Update debian apache2 to version 2.4.69-1.
- Update apache to version 2.4.69.
- Update apache2 to version 2.4.69-r0.
- Update apache http_server to version 2.4.69 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache http server | <= 2.4.68 |
| Debian:12 | debian | apache2 | All versions |
| – | apache | http_server |
>= 2.4.60, < 2.4.69 >= 2.4.0, < 2.4.69 cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | apache2 | All versions |
| Alpine:v3.21 | alpine | apache2 |
< 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| Alpaquita:23 | bellsoft | apache2 |
>= 2.4.54-r2, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| Alpaquita:25 | bellsoft | apache2 |
>= 2.4.63-r0, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| Alpaquita:stream | bellsoft | apache2 |
>= 2.4.56-r0, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| Debian:14 | debian | apache2 |
< 2.4.69-1 Fix: upgrade to 2.4.69-1
|
| Bitnami | – | apache |
>= 2.4.0, < 2.4.69 Fix: upgrade to 2.4.69
|
| Alpine:v3.21 | – | apache2 |
< 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
Original advisory text
BELL-CVE-2026-42356
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-42356 URL
- https://httpd.apache.org/security/vulnerabilities_24.html Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-42356 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/01/11 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-42356 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-42356 Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-42356 Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-42356 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-42356 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.7
Low
Type
CWE-430Deployment of Wrong Handler
Timeline
Published1 Oct 2026
Updated17 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-42356 · NVD
CVE-2026-42356 · MITRE
DEBIAN-CVE-2026-42356 · OSV
UBUNTU-CVE-2026-42356 · OSV
ALPINE-CVE-2026-42356 · OSV
BELL-CVE-2026-42356 · OSV
BIT-apache-2026-42356 · OSV
Track software like this
Free during beta