CVE-2026-24072

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	<= 2.4.66

References

https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/04/18Mailing List, Third Party Advisory

Timeline

Published: May 4, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-240737.8Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.CVE-2026-240747.8Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.CVE-2026-240757.0Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and ra CVE-2026-240766.7Memory Corruption when processing registry values with incorrect types using a direct query method.CVE-2026-240776.5Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.CVE-2026-240786.5Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.CVE-2026-240798.1Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.CVE-2026-24084.7Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.CVE-2026-240807.8Memory Corruption when handling malformed request parameters in the fingerprint TA.CVE-2026-240817.4Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.CVE-2026-240827.8Memory Corruption when copying data from a freed source while executing performance counter deselect operation.CVE-2026-240837.8Memory Corruption while processing IOCTL device driver requests with invalid arguments.