Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache 2.4.66 can crash or expose data
published 5 months ago
Summary
Web servers running Apache HTTP Server version 2.4.66 or earlier can be forced to stop working or reveal information when they act as a forward proxy or connect to untrusted back‑end servers. The problem is caused by several coding errors that let remote users cause crashes or read data they shouldn't. Updating the server to version 2.4.67 resolves all of these issues.
What to do
- Update openeuler httpd to version 2.4.58-15.oe2403sp3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP3 | openeuler | httpd |
< 2.4.58-15.oe2403sp3 Fix: upgrade to 2.4.58-15.oe2403sp3
|
Original advisory text
httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.
Security Fix(es):
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.
Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33007)
HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.
This issue affects Apache HTTP Server: from through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33523)
Out-of-bounds Read vulnerability in mod_proxy_ajp of
Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33857)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34032)
Security Fix(es):
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.
Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33007)
HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.
This issue affects Apache HTTP Server: from through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33523)
Out-of-bounds Read vulnerability in mod_proxy_ajp of
Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-33857)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34032)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33007 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33523 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33857 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34032 Vendor Advisory
Timeline
Published22 May 2026
Updated22 May 2026
First seen22 May 2026
Sources
OESA-2026-2400 · OSV
Track software like this
Free during beta