CVE-2026-42536

HighCVSS 7.5/10Last modified Sep 14, 2026

Description

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122CWE-120

Affected software

VendorProductVersions
Apache Software FoundationApache HTTP Server>= 2.4.0, <= 2.4.67
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services for RHEL 8—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat JBoss Core Services 2.4.62.SP5—
Red HatRed Hat Hardened Images—
Red HatRed Hat Insights proxy 1.5—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—

References

Timeline

Published
Jun 8, 2026
Last modified
Sep 14, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-425379.8Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this iCVE-2026-425386.3IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-425396.5IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-42549.8A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToCVE-2026-425404.3IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-425414.3Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissiCVE-2026-425427.5TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthentCVE-2026-425434.3IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-425447.5Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sCVE-2026-425455.9Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns anCVE-2026-425463.8OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2026-425475.4IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.