Cyber ·
Ubuntu notice USN-9090-1: vulnerabilities in Apache HTTP Server and denial-of-service risk
Ubuntu Security published notice USN-9090-1 on flaws in Apache HTTP Server modules, listing five CVE identifiers. According to the text, they can cause denial of service and, in some cases, code execution.
Ubuntu Security notice USN-9090-1 describes flaws in Apache HTTP Server modules. According to the text, they can cause denial of service and, in some cases, code execution. The items listed are: CVE-2026-42528, in mod_dav, where memory sizes were miscalculated when handling WebDAV locks, which can crash the server; the attacker must be allowed to create WebDAV locks. CVE-2026-109163, in mod_vhost_alias, a one-byte stack buffer overflow triggered by certain requests; the text says a remote attacker could possibly cause a crash or execute arbitrary code. CVE-2026-106023, in mod_md, a NULL pointer dereference under certain conditions, with possible denial of service; the notice says this issue affected only Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10. CVE-2026-119618, in mod_http2, heap corruption caused by certain request headers, with possible denial of service or arbitrary code execution by a remote attacker; it also affected only the same Ubuntu releases. CVE-2026-42356, where Apache may treat the target of some internal redirects from CGI programs as a CGI program, possibly allowing arbitrary code execution by a remote attacker; it affected only Ubuntu 26.04 LTS and 26.10. Discovery credits appear in the original text. This content is an automatic translation of the Ubuntu Security feed. To confirm package versions, available fixes and recommendations, consult the original notice published by Ubuntu.
Original source: USN-9090-1: vulnerabilidades no Apache HTTP Server