CVE-2026-47360

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47360
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47360.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47360
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (1)
OESA (4)
RHSA (1)
ROOT (1)
SUSE (4)
UBUNTU (1)
Related
SUSE (4)
Published
2026-10-01T16:00:51Z
Modified
2026-11-05T21:32:23Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Details

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.

 
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47360.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "2.4.0"
                        },
                        {
                            "last_affected": "2.4.68"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
15e7241fa52e86096ee061e1b7fca0cd8d6f53ee
Fixed
1e06e9860794ce39605b79a0a787abfe084e5677
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.4.60"
                },
                {
                    "fixed": "2.4.69"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47360.json"