Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-59685: Apache HTTP Server on Windows can write outside memory
CVE-2026-59685 · published 1 month ago
Summary
Versions 2.4.0 through 2.4.68 of Apache HTTP Server running on Windows may write data outside its intended memory area when handling short (8.3) file names. This can cause the server to crash or be taken over by an attacker. Upgrade to the latest Apache release or apply the security patch provided by your distribution to fix the issue.
What to do
- Update alpine apache2 to version 2.4.69-r0.
- Update bellsoft apache2 to version 2.4.69-r0.
- Update apache to version 2.4.69.
- Update apache2 to version 2.4.69-r0.
- Update apache http_server to version 2.4.69 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache http server | <= 2.4.68 |
| Debian:12 | debian | apache2 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | apache2 | All versions |
| Alpine:v3.21 | alpine | apache2 |
< 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| Alpaquita:23 | bellsoft | apache2 |
>= 2.4.54-r2, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| Alpaquita:25 | bellsoft | apache2 |
>= 2.4.63-r0, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| Alpaquita:stream | bellsoft | apache2 |
>= 2.4.56-r0, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
| – | apache | http_server |
>= 2.4.0, < 2.4.69 cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| Bitnami | – | apache |
>= 2.4.0, < 2.4.69 Fix: upgrade to 2.4.69
|
| Alpine:v3.21 | – | apache2 |
< 2.4.69-r0 Fix: upgrade to 2.4.69-r0
|
Original advisory text
BELL-CVE-2026-59685
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
References
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-59685 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/01/21 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-59685 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-59685 Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-59685 Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-59685 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-59685 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59685 URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-787Out-of-bounds Write
Timeline
Published1 Oct 2026
Updated4 Nov 2026
First seen1 Oct 2026
Sources
CVE-2026-59685 · NVD
CVE-2026-59685 · MITRE
DEBIAN-CVE-2026-59685 · OSV
UBUNTU-CVE-2026-59685 · OSV
ALPINE-CVE-2026-59685 · OSV
BELL-CVE-2026-59685 · OSV
BIT-apache-2026-59685 · OSV
Track software like this
Free during beta