USN-9090-1: Apache HTTP Server vulnerabilities

Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42528)

It was discovered that Apache HTTP Server's mod_vhost_alias module incorrectly handled certain requests, leading to a one-byte stack buffer overflow. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-109163)

It was discovered that Apache HTTP Server's mod_md module incorrectly handled certain conditions, leading to a NULL pointer dereference. An attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-106023)

It was discovered that Apache HTTP Server's mod_http2 module incorrectly handled certain request headers, leading to heap corruption. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119618)

Feliks Penconek, Yang Song, and JiaSheng He discovered that Apache HTTP Server could treat the target of some internal redirects from CGI programs as a CGI program. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-42356)