Description
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
https://httpd.apache.org/security/vulnerabilities_24.html
Scores
CVSS v3
7.5
EPSS
0.0050
EPSS Percentile
38.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-122
Status
published
Products (2)
apache/http_server
2.4.0 - 2.4.68
Apache Software Foundation/Apache HTTP Server
2.4.0 - 2.4.67
Published
Jun 08, 2026
Tracked Since
Jun 08, 2026