USN-8516-1: Apache HTTP Server vulnerabilities

unknownCVE-2026-29167 CVE-2026-29170 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536

It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-29167) It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170) It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34355) It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34356) It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535) It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42536) It was discovered that Apache HTTP Server incorrectly handled response headers when multiple content languages were configured. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43951) It was discovered that Apache HTTP Server incorrectly restricted certain file functions in expressions within .htaccess files. A local attacker with .htaccess write access could possibly use this issue to obt

CSIRTS triage

vendor: Apache product: Apache HTTP Server Denial of service Remote code execution

What: Multiple vulnerabilities could lead to server crashes or arbitrary code execution.
Who is affected: Users of Apache HTTP Server.
Urgency: Remediation is important due to the potential for exploitation.
Action: Update to the latest version of Apache HTTP Server.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Apache HTTP Server

Get an email when a new Apache HTTP Server advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-08
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8516-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-291670.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all scored CVEs.
Low exploitation riskCVE-2026-291700.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.
Low exploitation riskCVE-2026-343550.80% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all scored CVEs.
Low exploitation riskCVE-2026-343560.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all scored CVEs.
Low exploitation riskCVE-2026-425350.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
Low exploitation riskCVE-2026-425360.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all scored CVEs.
Low exploitation riskCVE-2026-439510.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
Low exploitation riskCVE-2026-441190.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all scored CVEs.
Low exploitation riskCVE-2026-441850.60% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all scored CVEs.
Low exploitation riskCVE-2026-441860.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-29167	coverage & exploitation status	NVD · CVE.org
CVE-2026-29170	coverage & exploitation status	NVD · CVE.org
CVE-2026-34355	coverage & exploitation status	NVD · CVE.org
CVE-2026-34356	coverage & exploitation status	NVD · CVE.org
CVE-2026-42535	coverage & exploitation status	NVD · CVE.org
CVE-2026-42536	coverage & exploitation status	NVD · CVE.org
CVE-2026-43951	coverage & exploitation status	NVD · CVE.org
CVE-2026-44119	coverage & exploitation status	NVD · CVE.org
CVE-2026-44185	coverage & exploitation status	NVD · CVE.org
CVE-2026-44186	coverage & exploitation status	NVD · CVE.org
CVE-2026-44631	coverage & exploitation status	NVD · CVE.org
CVE-2026-48913	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.