USN-9090-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-9090-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-9090-1
Upstream
CVE (5)
Related
UBUNTU (5)
Published
2026-11-12T21:25:57Z
Modified
2026-11-13T11:28:23Z
Summary
apache2 vulnerabilities
Details

Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42528)

It was discovered that Apache HTTP Server's mod_vhost_alias module incorrectly handled certain requests, leading to a one-byte stack buffer overflow. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-109163)

It was discovered that Apache HTTP Server's mod_md module incorrectly handled certain conditions, leading to a NULL pointer dereference. An attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-106023)

It was discovered that Apache HTTP Server's mod_http2 module incorrectly handled certain request headers, leading to heap corruption. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119618)

Feliks Penconek, Yang Song, and JiaSheng He discovered that Apache HTTP Server could treat the target of some internal redirects from CGI programs as a CGI program. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-42356)

References

Affected packages

Ubuntu:22.04:LTS
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.52-1ubuntu4.27

Affected versions

2.*
2.4.48-3.1ubuntu3
2.4.48-3.1ubuntu4
2.4.51-2ubuntu1
2.4.52-1ubuntu1
2.4.52-1ubuntu2
2.4.52-1ubuntu4
2.4.52-1ubuntu4.1
2.4.52-1ubuntu4.2
2.4.52-1ubuntu4.3
2.4.52-1ubuntu4.4
2.4.52-1ubuntu4.5
2.4.52-1ubuntu4.6
2.4.52-1ubuntu4.7
2.4.52-1ubuntu4.8
2.4.52-1ubuntu4.9
2.4.52-1ubuntu4.10
2.4.52-1ubuntu4.11
2.4.52-1ubuntu4.12
2.4.52-1ubuntu4.13
2.4.52-1ubuntu4.14
2.4.52-1ubuntu4.15
2.4.52-1ubuntu4.16
2.4.52-1ubuntu4.18
2.4.52-1ubuntu4.19
2.4.52-1ubuntu4.20
2.4.52-1ubuntu4.21
2.4.52-1ubuntu4.23
2.4.52-1ubuntu4.24
2.4.52-1ubuntu4.25
2.4.52-1ubuntu4.26

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.52-1ubuntu4.27"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.52-1ubuntu4.27"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.52-1ubuntu4.27"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.52-1ubuntu4.27"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.52-1ubuntu4.27"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.52-1ubuntu4.27"
        },
        {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.52-1ubuntu4.27"
        },
        {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.52-1ubuntu4.27"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-106023",
            "severity": [
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-119618",
            "severity": [
                {
                    "score": "high",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"
Ubuntu:24.04:LTS
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.58-1ubuntu8.19

Affected versions

2.*
2.4.57-2ubuntu2
2.4.57-2ubuntu3
2.4.58-1ubuntu1
2.4.58-1ubuntu2
2.4.58-1ubuntu6
2.4.58-1ubuntu7
2.4.58-1ubuntu8
2.4.58-1ubuntu8.1
2.4.58-1ubuntu8.2
2.4.58-1ubuntu8.3
2.4.58-1ubuntu8.4
2.4.58-1ubuntu8.5
2.4.58-1ubuntu8.6
2.4.58-1ubuntu8.7
2.4.58-1ubuntu8.8
2.4.58-1ubuntu8.10
2.4.58-1ubuntu8.11
2.4.58-1ubuntu8.12
2.4.58-1ubuntu8.13
2.4.58-1ubuntu8.15
2.4.58-1ubuntu8.16
2.4.58-1ubuntu8.17
2.4.58-1ubuntu8.18

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.58-1ubuntu8.19"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.58-1ubuntu8.19"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.58-1ubuntu8.19"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.58-1ubuntu8.19"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.58-1ubuntu8.19"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.58-1ubuntu8.19"
        },
        {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.58-1ubuntu8.19"
        },
        {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.58-1ubuntu8.19"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-106023",
            "severity": [
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-119618",
            "severity": [
                {
                    "score": "high",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"
Ubuntu:26.04:LTS
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.66-2ubuntu2.8

Affected versions

2.*
2.4.64-1ubuntu3
2.4.65-3ubuntu1
2.4.66-2ubuntu1
2.4.66-2ubuntu2
2.4.66-2ubuntu2.1
2.4.66-2ubuntu2.2
2.4.66-2ubuntu2.4
2.4.66-2ubuntu2.5
2.4.66-2ubuntu2.6
2.4.66-2ubuntu2.7

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.66-2ubuntu2.8"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.66-2ubuntu2.8"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.66-2ubuntu2.8"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.66-2ubuntu2.8"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.66-2ubuntu2.8"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.66-2ubuntu2.8"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42356",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-106023",
            "severity": [
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-119618",
            "severity": [
                {
                    "score": "high",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:26.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"
Ubuntu:26.10
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.68-1ubuntu6.2

Affected versions

2.*
2.4.66-2ubuntu2
2.4.68-1ubuntu4
2.4.68-1ubuntu6.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.68-1ubuntu6.2"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.68-1ubuntu6.2"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.68-1ubuntu6.2"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.68-1ubuntu6.2"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.68-1ubuntu6.2"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.68-1ubuntu6.2"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42356",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-106023",
            "severity": [
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-119618",
            "severity": [
                {
                    "score": "high",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"
Ubuntu:Pro:14.04:LTS
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.7-1ubuntu4.22+esm19

Affected versions

2.*
2.4.6-2ubuntu2
2.4.6-2ubuntu3
2.4.6-2ubuntu4
2.4.7-1ubuntu1
2.4.7-1ubuntu2
2.4.7-1ubuntu3
2.4.7-1ubuntu4
2.4.7-1ubuntu4.1
2.4.7-1ubuntu4.4
2.4.7-1ubuntu4.5
2.4.7-1ubuntu4.6
2.4.7-1ubuntu4.7
2.4.7-1ubuntu4.8
2.4.7-1ubuntu4.9
2.4.7-1ubuntu4.10
2.4.7-1ubuntu4.11
2.4.7-1ubuntu4.13
2.4.7-1ubuntu4.15
2.4.7-1ubuntu4.16
2.4.7-1ubuntu4.17
2.4.7-1ubuntu4.18
2.4.7-1ubuntu4.19
2.4.7-1ubuntu4.20
2.4.7-1ubuntu4.21
2.4.7-1ubuntu4.22
2.4.7-1ubuntu4.22+esm1
2.4.7-1ubuntu4.22+esm2
2.4.7-1ubuntu4.22+esm3
2.4.7-1ubuntu4.22+esm4
2.4.7-1ubuntu4.22+esm5
2.4.7-1ubuntu4.22+esm6
2.4.7-1ubuntu4.22+esm8
2.4.7-1ubuntu4.22+esm9
2.4.7-1ubuntu4.22+esm10
2.4.7-1ubuntu4.22+esm12
2.4.7-1ubuntu4.22+esm13
2.4.7-1ubuntu4.22+esm14
2.4.7-1ubuntu4.22+esm15
2.4.7-1ubuntu4.22+esm16
2.4.7-1ubuntu4.22+esm17
2.4.7-1ubuntu4.22+esm18

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-mpm-event",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-mpm-itk",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-mpm-prefork",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-mpm-worker",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-suexec",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "apache2.2-bin",
            "binary_version": "2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "libapache2-mod-macro",
            "binary_version": "1:2.4.7-1ubuntu4.22+esm19"
        },
        {
            "binary_name": "libapache2-mod-proxy-html",
            "binary_version": "1:2.4.7-1ubuntu4.22+esm19"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:Pro:14.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"
Ubuntu:Pro:16.04:LTS
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.18-2ubuntu3.17+esm24

Affected versions

2.*
2.4.12-2ubuntu2
2.4.17-1ubuntu1
2.4.17-2ubuntu1
2.4.17-3ubuntu1
2.4.18-1ubuntu1
2.4.18-2ubuntu1
2.4.18-2ubuntu2
2.4.18-2ubuntu3
2.4.18-2ubuntu3.1
2.4.18-2ubuntu3.2
2.4.18-2ubuntu3.3
2.4.18-2ubuntu3.4
2.4.18-2ubuntu3.5
2.4.18-2ubuntu3.7
2.4.18-2ubuntu3.8
2.4.18-2ubuntu3.9
2.4.18-2ubuntu3.10
2.4.18-2ubuntu3.12
2.4.18-2ubuntu3.13
2.4.18-2ubuntu3.14
2.4.18-2ubuntu3.15
2.4.18-2ubuntu3.17
2.4.18-2ubuntu3.17+esm1
2.4.18-2ubuntu3.17+esm2
2.4.18-2ubuntu3.17+esm3
2.4.18-2ubuntu3.17+esm4
2.4.18-2ubuntu3.17+esm5
2.4.18-2ubuntu3.17+esm6
2.4.18-2ubuntu3.17+esm7
2.4.18-2ubuntu3.17+esm8
2.4.18-2ubuntu3.17+esm9
2.4.18-2ubuntu3.17+esm10
2.4.18-2ubuntu3.17+esm11
2.4.18-2ubuntu3.17+esm12
2.4.18-2ubuntu3.17+esm13
2.4.18-2ubuntu3.17+esm14
2.4.18-2ubuntu3.17+esm16
2.4.18-2ubuntu3.17+esm17
2.4.18-2ubuntu3.17+esm18
2.4.18-2ubuntu3.17+esm19
2.4.18-2ubuntu3.17+esm20
2.4.18-2ubuntu3.17+esm21
2.4.18-2ubuntu3.17+esm22
2.4.18-2ubuntu3.17+esm23

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.18-2ubuntu3.17+esm24"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.18-2ubuntu3.17+esm24"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.18-2ubuntu3.17+esm24"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.18-2ubuntu3.17+esm24"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.18-2ubuntu3.17+esm24"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.18-2ubuntu3.17+esm24"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"
Ubuntu:Pro:18.04:LTS
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.29-1ubuntu4.27+esm15

Affected versions

2.*
2.4.27-2ubuntu3
2.4.29-1ubuntu1
2.4.29-1ubuntu2
2.4.29-1ubuntu3
2.4.29-1ubuntu4
2.4.29-1ubuntu4.1
2.4.29-1ubuntu4.2
2.4.29-1ubuntu4.3
2.4.29-1ubuntu4.4
2.4.29-1ubuntu4.5
2.4.29-1ubuntu4.6
2.4.29-1ubuntu4.7
2.4.29-1ubuntu4.8
2.4.29-1ubuntu4.10
2.4.29-1ubuntu4.11
2.4.29-1ubuntu4.12
2.4.29-1ubuntu4.13
2.4.29-1ubuntu4.14
2.4.29-1ubuntu4.16
2.4.29-1ubuntu4.17
2.4.29-1ubuntu4.18
2.4.29-1ubuntu4.19
2.4.29-1ubuntu4.20
2.4.29-1ubuntu4.21
2.4.29-1ubuntu4.22
2.4.29-1ubuntu4.23
2.4.29-1ubuntu4.24
2.4.29-1ubuntu4.25
2.4.29-1ubuntu4.26
2.4.29-1ubuntu4.27
2.4.29-1ubuntu4.27+esm1
2.4.29-1ubuntu4.27+esm2
2.4.29-1ubuntu4.27+esm3
2.4.29-1ubuntu4.27+esm4
2.4.29-1ubuntu4.27+esm6
2.4.29-1ubuntu4.27+esm7
2.4.29-1ubuntu4.27+esm8
2.4.29-1ubuntu4.27+esm9
2.4.29-1ubuntu4.27+esm10
2.4.29-1ubuntu4.27+esm11
2.4.29-1ubuntu4.27+esm12
2.4.29-1ubuntu4.27+esm13
2.4.29-1ubuntu4.27+esm14

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.29-1ubuntu4.27+esm15"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.29-1ubuntu4.27+esm15"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.29-1ubuntu4.27+esm15"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.29-1ubuntu4.27+esm15"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.29-1ubuntu4.27+esm15"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.29-1ubuntu4.27+esm15"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"
Ubuntu:Pro:20.04:LTS
apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.41-4ubuntu3.23+esm11

Affected versions

2.*
2.4.41-1ubuntu1
2.4.41-4ubuntu1
2.4.41-4ubuntu2
2.4.41-4ubuntu3
2.4.41-4ubuntu3.1
2.4.41-4ubuntu3.3
2.4.41-4ubuntu3.4
2.4.41-4ubuntu3.5
2.4.41-4ubuntu3.6
2.4.41-4ubuntu3.7
2.4.41-4ubuntu3.8
2.4.41-4ubuntu3.9
2.4.41-4ubuntu3.10
2.4.41-4ubuntu3.11
2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.13
2.4.41-4ubuntu3.14
2.4.41-4ubuntu3.15
2.4.41-4ubuntu3.16
2.4.41-4ubuntu3.17
2.4.41-4ubuntu3.19
2.4.41-4ubuntu3.20
2.4.41-4ubuntu3.21
2.4.41-4ubuntu3.23
2.4.41-4ubuntu3.23+esm2
2.4.41-4ubuntu3.23+esm3
2.4.41-4ubuntu3.23+esm4
2.4.41-4ubuntu3.23+esm5
2.4.41-4ubuntu3.23+esm6
2.4.41-4ubuntu3.23+esm7
2.4.41-4ubuntu3.23+esm8
2.4.41-4ubuntu3.23+esm9
2.4.41-4ubuntu3.23+esm10

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "apache2",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        },
        {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        },
        {
            "binary_name": "apache2-data",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        },
        {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        },
        {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        },
        {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        },
        {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        },
        {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.41-4ubuntu3.23+esm11"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-42528",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-106023",
            "severity": [
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-109163",
            "severity": [
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-119618",
            "severity": [
                {
                    "score": "high",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9090-1.json"