Ubuntu alert USN-8516-1 (apache2)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8516-1] Apache HTTP Server vulnerabilities
Date:
             
 
Wed, 08 Jul 2026 15:31:32 +0000
Message-ID:
             
 
<E1whUFI-0003wM-Kh@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8516-1
July 08, 2026

apache2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in Apache HTTP Server.

Software Description:
- apache2: Apache HTTP server

Details:

It was discovered that Apache HTTP Server's mod_ldap module incorrectly
handled memory when processing per-directory configurations. An attacker
could use this issue to cause the server to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-29167)

It was discovered that Apache HTTP Server's mod_proxy_ftp module
incorrectly handled HTML generation for FTP directory listings. A remote
attacker could possibly use this issue to inject arbitrary web script or
HTML. (CVE-2026-29170)

It was discovered that Apache HTTP Server's mod_proxy_html module
incorrectly handled certain content from an untrusted backend. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. (CVE-2026-34355)

It was discovered that Apache HTTP Server incorrectly handled
ProxyPassReverseCookie directives with a malicious backend server. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. (CVE-2026-34356)

It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly
handled certain path operations. An authenticated user could possibly use
this issue to manipulate trusted WebDAV property databases or cause a
denial of service. (CVE-2026-42535)

It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly
handled certain content from an untrusted backend. A remote attacker could
possibly use this issue to cause Apache HTTP Server to crash, resulting in
a denial of service. (CVE-2026-42536)

It was discovered that Apache HTTP Server incorrectly handled response
headers when multiple content languages were configured. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2026-43951)

It was discovered that Apache HTTP Server incorrectly restricted certain
file functions in expressions within .htaccess files. A local attacker with
.htaccess write access could possibly use this issue to obtain sensitive
information. (CVE-2026-44119)

It was discovered that Apache HTTP Server's mod_ssl module incorrectly
handled OCSP responses from an attacker-controlled server. A remote
attacker could possibly use this issue to obtain sensitive information or
cause a denial of service. (CVE-2026-44185)

It was discovered that Apache HTTP Server's mod_proxy_ftp module
incorrectly handled responses from an attacker-controlled backend FTP
server. A remote attacker could possibly use this issue to cause Apache
HTTP Server to stop responding, resulting in a denial of service.
(CVE-2026-44186)

It was discovered that Apache HTTP Server incorrectly handled crafted
regular expressions in the server configuration. An attacker could possibly
use this issue to execute arbitrary code or cause a denial of service.
(CVE-2026-44631)

It was discovered that Apache HTTP Server's mod_http2 module had a
use-after-free vulnerability when file handles were exhausted. A remote
attacker could possibly use this issue to cause Apache HTTP Server to
crash, resulting in a denial of service. (CVE-2026-48913)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  apache2                         2.4.66-2ubuntu2.4

Ubuntu 24.04 LTS
  apache2                         2.4.58-1ubuntu8.15

Ubuntu 22.04 LTS
  apache2                         2.4.52-1ubuntu4.23

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8516-1
  CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
  CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
  CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913

Package Information:
  https://launchpad.net/ubuntu/+source/apache2/2.4.66-2ubun...
  https://launchpad.net/ubuntu/+source/apache2/2.4.58-1ubun...
  https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubun...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpObK0ACgkQcpJm3tlz
hgET2hAAvH6lqDtgTufH2ulQGoFNbUve8J9Mt2lS+vK51fPV1mtH6z7T3q5/LFfT
8YSQa6HgjLTvX+Lw6QmkZJ+slEr9iRq7YiXHHkZd0gkgXwx/dSze7qvt6K+f8N7L
K3PsWpCv9WsRx91Yun0DJ9FtkZ5wrngf44h0N9/pSKIqzUT/JbB0O13NqjDoMrDl
qAT2FT+yK8L8hlN16TSkvlaLcXDlkpOsQzElxvMrEvWs0MLf+BhuijSQ/vghj+dw
FNi7XaRJd9gou9Cs7t+HvAD0uzyVoVBI2gPPKszl8965PQEOGhKLQQwvhBguk3AE
YbHVmB5uesapVB/cGfYihGrSVWTI9W08lqZQpFTd2mXcz38r0V9PUIDS6fxCB3eO
AcvK96s/FVXmTKGDXKdW3DK81+AsfrNZRXMwaNLmNRVZxfTHgTBsbGqf6GmnXWhK
Uo2NcYZSEfYKocSCGj82QS5CdFCrB+OVN6ZJEqCNibK8pMaq0yq3Bjj4RzzBbrD/
jOr2PqORpTM+TYHd0ZNQRSSSD+IR3Z3ggw605CS+nyPikV3LfOG6OyA4YFNyGrFQ
a2IzfT0xnZmstF3IC56Cp/pKnrwldOBAgb80+xMnwn9OEMl7JMEgHJtEWslsmgO7
gaEn0Hnp0/Z00jLeFWl2eaumBdiQ5u/2IU8u15mE5jfOI7QySLY=
=eMDo
-----END PGP SIGNATURE-----