Back to search

Apache Software Foundation

Apache HTTP Server

See the latest tracked release, confirm when it was published, and subscribe for update emails.

Current version
Last checked: 2026-09-04

2.4.68

Release date
June 08, 2026
Security status
10 high-severity CVEs tracked in the last 90 days. Current version not affected.

Source

GitHub API

Public release notes are linked for the latest stored release.

View release notes Subscribe to updates

Release history

See the latest published releases stored for this product.

Version Published Notes
2.4.68 2026-06-08 Release Notes
2.4.67 2026-05-04 Release Notes
2.4.66 2025-12-04 Release Notes

Vulnerability tracking

versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.

Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.

CVE Severity Published Status Summary
CVE-2026-49975 HIGH (7.5) 2026-06-08 Current versionnot affected

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Affected versions
  • From (including) 2.4.17 - Up to (including) 2.4.67
CVE-2026-48913 HIGH (7.3) 2026-06-08 Current versionnot affected

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

Affected versions
  • From (including) 2.4.55 - Up to (including) 2.4.67
CVE-2026-42536 HIGH (7.5) 2026-06-08 Current versionnot affected

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected versions
  • From (including) 2.4.0 - Up to (including) 2.4.67
CVE-2026-44185 HIGH (7.3) 2026-06-08 Current versionnot affected

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected versions
  • From (including) 2.4.0 - Up to (including) 2.4.67
CVE-2026-34355 HIGH (7.5) 2026-06-08 Current versionnot affected

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Affected versions
  • From (including) 2.4.0 - Up to (including) 2.4.67
CVE-2026-44631 CRITICAL (9.8) 2026-06-08 Current versionnot affected

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected versions
  • From (including) 2.4.0 - Up to (including) 2.4.67
CVE-2026-42535 CRITICAL (9.1) 2026-06-08 Current versionnot affected

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Affected versions
  • From (including) 0 - Up to (including) 2.4.67
CVE-2026-34356 HIGH (7.5) 2026-06-08 Current versionnot affected

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected versions
  • From (including) 2.4.0 - Up to (including) 2.4.67
CVE-2026-44186 HIGH (7.3) 2026-06-08 Current versionnot affected

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected versions
  • From (including) 2.4.0 - Up to (including) 2.4.67
CVE-2026-29167 CRITICAL (9.8) 2026-06-08 Current versionnot affected

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected versions
  • From (including) 2.4.0 - Up to (including) 2.4.67