USN-9016-1: Apache HTTP Server vulnerabilities

Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka, Keita Sode and Hyojae Lee discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-46729)

It was discovered that Apache HTTP Server did not correctly handle certain session cookies. A remote attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-47360)

Zhen Kong discovered that Apache HTTP Server did not correctly handle certain forms of authentication. An unauthenticated remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-48005)

Bartlomiej Dmitruk and Masumi Tanaka discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-56153)

Lucian Nitescu discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-56449)

It was discovered that Apache HTTP Server’s mod_rewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-56154)

Lucian Nitescu, Simon Kappel, and Gianluca Danesin discovered that Apache HTTP Server’s mod_http2 module incorrectly handled memory when processing certain HTTP/2 connections. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-57941)

Juthawong Naisanguansee, Charles Vosburgh, Mike Read, and Ryoma Nishioka discovered that Apache HTTP Server’s mod_ssl module incorrectly handled certain expressions. An attacker could possibly use this issue to bypass intended access restrictions. This issue only affected Ubuntu 26.10. (CVE-2026-59797)

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-58415)

Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. This issue only affected Ubuntu 26.10. (CVE-2026-63045)

Hyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-63292)

Lucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not properly handle certain responses from backend servers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-63686)

Qing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP responses from backend servers. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks. This issue only affected Ubuntu 26.10. (CVE-2026-63718)

Hyojae Lee discovered that Apache HTTP Server did not properly validate Digest authentication requests. A machine-in-the-middle attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 26.10. (CVE-2026-73636)

Zhen Kong and Darren Carreras discovered that Apache HTTP Server did not properly manage authentication requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-73637)

Vlatko Kosturjak discovered that Apache HTTP Server did not properly enforce access restrictions for user directories. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-79768)

Zhen Kong discovered that Apache HTTP Server did not properly handle certain WebDAV requests. An authenticated user could possibly use this issue to cause a denial of service or corrupt WebDAV property data. This issue only affected Ubuntu 26.10. (CVE-2026-93546)