SUSE-SU-2026:5076-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-20265076-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2026:5076-1

Upstream

CVE (18)

CVE-2026-42356
CVE-2026-42528
CVE-2026-46729
CVE-2026-47360
CVE-2026-48005
CVE-2026-56153
CVE-2026-56154
CVE-2026-57941
CVE-2026-58415
CVE-2026-59797
CVE-2026-63045
CVE-2026-63292
CVE-2026-63686
CVE-2026-63718
CVE-2026-73636
CVE-2026-73637
CVE-2026-79768
CVE-2026-93546

Related

CVE (18)

CVE-2026-42356
CVE-2026-42528
CVE-2026-46729
CVE-2026-47360
CVE-2026-48005
CVE-2026-56153
CVE-2026-56154
CVE-2026-57941
CVE-2026-58415
CVE-2026-59797
CVE-2026-63045
CVE-2026-63292
CVE-2026-63686
CVE-2026-63718
CVE-2026-73636
CVE-2026-73637
CVE-2026-79768
CVE-2026-93546

Published

2026-11-03T08:19:40Z

Modified

2026-11-03T22:45:04Z

Summary

Security update for apache2

Details

This update for apache2 fixes the following issues:

CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed (bsc#1284043).
CVE-2026-42528: memory calculation bug in mod_dav allows an attacker with permission to create WebDAV locks to crash server child processes (bsc#1284044).
CVE-2026-46729: NULL pointer dereference in mod_heartmonitor over unicast listener (bsc#1284045).
CVE-2026-47360: session cookie passed to a backend server when SessionCookieRemove changes across internal redirects (bsc#1284046).
CVE-2026-48005: missing authentication checks in mod_auth_digest allows an unauthenticated remote client to cause a DoS via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck (bsc#1284047).
CVE-2026-56153: out-of-bounds write in mod_charset_lite (bsc#1284048).
CVE-2026-56154: use-after-free in mod_rewrite when using lookahead (%{LA-U:HTTP:...}) (bsc#1284049).
CVE-2026-57941: use-after-free in mod_http2 via shared session->bbtmp re-entrancy (bsc#1284050).
CVE-2026-58415: internal state files accessible to external parties in mod_dav_fs allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory (bsc#1284051).
CVE-2026-59797: improper privilege management in mod_ssl when using SSLRequire and file-related expressions (bsc#1284059).
CVE-2026-63045: improper validation of FTP PASV reply address in mod_proxy_ftp allows an untrusted FTP server to cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060).
CVE-2026-63292: stack-based buffer overflow in mod_vhost_alias allows a remote client to cause a DoS or potentially execute arbitrary code via an HTTP request with a specially crafted Host header (bsc#1284061).
CVE-2026-63686: NULL pointer dereference in mod_xml2enc allows an untrusted backend server to cause a denial of service via a crafted proxied response (bsc#1284058).
CVE-2026-63718: inconsistent interpretation of HTTP requests in mod_proxy_uwsgi allows for response smuggling via a crafted uwsgi response with Transfer-Encoding (bsc#1284057).
CVE-2026-73636: authentication bypass by capture-replay in mod_auth_digest allows a MiTM attacker to replay captured digest authentication credentials via crafted requests (bsc#1284056).
CVE-2026-73637: use-after-free in mod_auth_digest allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests (bsc#1284055).
CVE-2026-79768: path equivalence issue in the mod_userdir module when configured with absolute non-wildcard UserDir directive (bsc#1284054).
CVE-2026-93546: integer overflow in mod_dav_fs allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database (bsc#1284053).

References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"

SUSE:Linux Enterprise Server 15 SP4-LTSS

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"

SUSE:Linux Enterprise Server 15 SP5-LTSS

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP4

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP5

apache2

Package

Name: apache2
Purl: pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.66-150400.6.60.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2": "2.4.66-150400.6.60.1",
            "apache2-devel": "2.4.66-150400.6.60.1",
            "apache2-doc": "2.4.66-150400.6.60.1",
            "apache2-prefork": "2.4.66-150400.6.60.1",
            "apache2-utils": "2.4.66-150400.6.60.1",
            "apache2-worker": "2.4.66-150400.6.60.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5076-1.json"