Apache 2.4.x < 2.4.68 Multiple Vulnerabilities

Apache 2.4.68 patches 13 CVEs spanning use-after-free conditions (CVE-2026-29167 in mod_ldap, CVE-2026-48913 in mod_http2), heap/stack buffer overflows (CVE-2026-34355 in mod_proxy_html, CVE-2026-42536 in mod_xml2enc, CVE-2026-34356 in ProxyPassReverseCookieMap), a DoS memory bomb (CVE-2026-49975 in mod_http2), a privilege-escalation via .htaccess expressions (CVE-2026-44119), an XSS in mod_proxy_ftp (CVE-2026-29170), an OOB read in merge_response_headers (CVE-2026-43951), a mod_ssl OCSP over-read (CVE-2026-44185), a mod_proxy_ftp infinite loop (CVE-2026-44186), a heap underflow in ap_regname (CVE-2026-44631), and a mod_dav_fs path-traversal (CVE-2026-42535). All affect Apache 2.4.0–2.4.67 except CVE-2026-48913 (2.4.55–2.4.67) and CVE-2026-49975 (2.4.17–2.4.67).

The NVD's CVSS v3.1 of 9.8 Critical is driven entirely by CVE-2026-29167 (mod_ldap UAF), but this score wildly overstates real-world risk. Red Hat independently scored CVE-2026-29167 at 4.6 Low — noting mod_ldap is not loaded by default, per-directory LDAP config is rare, and httpd's worker-process model kills RCE reliability. Apache's own project rated it *Low*. The operationally relevant headline CVE is CVE-2026-49975 (HTTP/2 Bomb): unauthenticated, remote, DoS-only, but with 11+ public PoC repositories, an EPSS of 0.343, and applicability to any server with HTTP/2 enabled — which is most of them. Tenable's VPR of 7.6 (High) is the most honest score in the room. The vendor-implied CRITICAL is wrong; HIGH is right.

1. Deploy HTTP/2 connection and stream limits immediately — Set H2MaxSessionStreams 100, H2MaxWorkers 128, and reduce Timeout / H2Timeout to 30s in httpd.conf. This does not fully prevent the bomb but limits amplification factor and memory pinning duration. Deploy within the noisgate mitigation SLA of 30 days for HIGH severity.
2. Place Apache behind an HTTP/2-terminating reverse proxy or CDN — Route traffic through Cloudflare, AWS ALB, Azure Front Door, HAProxy (≥2.8.10 with June 2026 patch), or nginx (≥1.27.5) that terminates HTTP/2 before it reaches Apache. The upstream proxy absorbs the HPACK bomb. This is the single most effective compensating control.
3. Apply per-process memory limits via cgroups/systemd — Set MemoryMax=512M (or appropriate for your workload) on the httpd.service unit. When a worker hits the limit, the OOM killer terminates only that process — not the parent. Combined with MaxRequestWorkers, this bounds the blast radius of memory exhaustion to brief worker restarts.
4. Disable mod_ldap if unused — Run a2dismod ldap authnz_ldap (Debian/Ubuntu) or remove LoadModule ldap_module from httpd.conf (RHEL). This completely eliminates CVE-2026-29167 (the 9.8 NVD score). If mod_ldap is required, move LDAP directives out of per-directory contexts (.htaccess, <Directory>) into server/vhost-level config to mitigate the per-directory merge UAF.
5. Disable unused proxy and content-filter modules — Unload mod_proxy_html, mod_xml2enc, mod_proxy_ftp, mod_dav_fs if not in use. Each eliminates one or more CVEs in this bundle (CVE-2026-34355, CVE-2026-42536, CVE-2026-29170, CVE-2026-44186, CVE-2026-42535). Reducing loaded module count is free attack-surface reduction.
6. Upgrade to Apache 2.4.68 — The definitive fix. Apply within the noisgate remediation SLA of 180 days (by 2027-03-20 from today). Distro backports are available for RHEL, Ubuntu 20.04–26.04, Debian Bookworm/Bullseye/Trixie. Prioritize internet-facing instances first.

Run on each target Apache host as root (or any user that can read the httpd binary and module config). Example: sudo bash check_apache_2.4.68.sh. The script checks the installed Apache version, identifies whether the HTTP/2 and LDAP modules are loaded (the two highest-risk attack surfaces), and outputs VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# noisgate — Apache 2.4.68 multi-CVE check (Tenable 319665)
# Checks: version < 2.4.68, mod_http2 loaded (CVE-2026-49975),
#         mod_ldap loaded (CVE-2026-29167)
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

HTTPD=""
for candidate in httpd apache2 /usr/sbin/httpd /usr/sbin/apache2; do
  if command -v "$candidate" &>/dev/null; then
    HTTPD="$(command -v "$candidate")"
    break
  fi
done

if [[ -z "$HTTPD" ]]; then
  echo "UNKNOWN — Apache httpd binary not found on this host."
  exit 2
fi

# Extract version
VERSION_STR=$($HTTPD -v 2>/dev/null | grep -oP 'Apache/\K[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$VERSION_STR" ]]; then
  echo "UNKNOWN — could not parse Apache version from '$HTTPD -v'."
  exit 2
fi

MAJOR=$(echo "$VERSION_STR" | cut -d. -f1)
MINOR=$(echo "$VERSION_STR" | cut -d. -f2)
PATCH=$(echo "$VERSION_STR" | cut -d. -f3)

echo "Detected Apache/$VERSION_STR at $HTTPD"

# Check for distro backports (package version may differ from binary version)
PKG_VER=""
if command -v rpm &>/dev/null; then
  PKG_VER=$(rpm -q httpd --qf '%{VERSION}-%{RELEASE}' 2>/dev/null || true)
elif command -v dpkg-query &>/dev/null; then
  PKG_VER=$(dpkg-query -W -f='${Version}' apache2 2>/dev/null || true)
fi
[[ -n "$PKG_VER" ]] && echo "Package version: $PKG_VER"

# Version comparison: vulnerable if < 2.4.68
if [[ "$MAJOR" -lt 2 ]] || \
   { [[ "$MAJOR" -eq 2 ]] && [[ "$MINOR" -lt 4 ]]; } || \
   { [[ "$MAJOR" -eq 2 ]] && [[ "$MINOR" -eq 4 ]] && [[ "$PATCH" -lt 68 ]]; }; then
  VULN=true
else
  VULN=false
fi

# Check loaded modules for risk context
MODULES=$($HTTPD -M 2>/dev/null || true)
H2_LOADED=false
LDAP_LOADED=false
[[ "$MODULES" == *"http2_module"* ]] && H2_LOADED=true
[[ "$MODULES" == *"ldap_module"* ]] && LDAP_LOADED=true

if $VULN; then
  echo "VULNERABLE — Apache/$VERSION_STR is below 2.4.68."
  $H2_LOADED && echo "  [!] mod_http2 is loaded — exposed to CVE-2026-49975 (HTTP/2 Bomb DoS)."
  $LDAP_LOADED && echo "  [!] mod_ldap is loaded — exposed to CVE-2026-29167 (UAF, NVD 9.8 / RH 4.6)."
  ! $H2_LOADED && echo "  [i] mod_http2 not loaded — CVE-2026-49975 does not apply."
  ! $LDAP_LOADED && echo "  [i] mod_ldap not loaded — CVE-2026-29167 does not apply."
  echo "  Remediation: upgrade to Apache 2.4.68 or apply distro backport."
  exit 1
else
  echo "PATCHED — Apache/$VERSION_STR is 2.4.68 or later."
  exit 0
fi

1. Tenable Plugin 319665
2. Apache HTTP Server 2.4 Vulnerabilities
3. CyberSecurityNews — Apache 2.4.68 Release
4. SOCPrime — CVE-2026-49975 Analysis
5. Red Hat — CVE-2026-29167
6. Red Hat — CVE-2026-49975 (RHSB-2026-007)
7. Manisso HTTP/2 Bomb PoC
8. Ubuntu CVE Tracker — CVE-2026-49975