USN-8516-1: Apache HTTP Server vulnerabilities

unknownCVE-2026-29167 CVE-2026-29170 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536

It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-29167) It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170) It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34355) It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34356) It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535) It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42536) It was discovered that Apache HTTP Server incorrectly handled response headers when multiple content languages were configured. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43951) It was discovered that Apache HTTP Server incorrectly restricted certain file functions in expressions within .htaccess files. A local attacker with .htaccess write access could possibly use this issue to obt

CSIRTS triage

vendor: Apache product: Apache HTTP Server Denial of service Remote code execution

What: Multiple vulnerabilities could lead to server crashes or arbitrary code execution.
Who is affected: Users of Apache HTTP Server.
Urgency: Remediation is important due to the potential for exploitation.
Action: Update to the latest version of Apache HTTP Server.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Apache HTTP Server

Get an email when a new Apache HTTP Server advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-08
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8516-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-291670.69% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-291700.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-343551.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 63% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-343560.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-425350.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-425360.99% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-439510.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-441190.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-441850.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-441860.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-29167	coverage & exploitation status	NVD · CVE.org
CVE-2026-29170	coverage & exploitation status	NVD · CVE.org
CVE-2026-34355	coverage & exploitation status	NVD · CVE.org
CVE-2026-34356	coverage & exploitation status	NVD · CVE.org
CVE-2026-42535	coverage & exploitation status	NVD · CVE.org
CVE-2026-42536	coverage & exploitation status	NVD · CVE.org
CVE-2026-43951	coverage & exploitation status	NVD · CVE.org
CVE-2026-44119	coverage & exploitation status	NVD · CVE.org
CVE-2026-44185	coverage & exploitation status	NVD · CVE.org
CVE-2026-44186	coverage & exploitation status	NVD · CVE.org
CVE-2026-44631	coverage & exploitation status	NVD · CVE.org
CVE-2026-48913	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] Apache HTTP Server: Multiple vulnerabilitiescert-bund
unknownNCSC-2026-0309 [1.00] [M/H] Vulnerabilities resolved in Oracle Communicationsncsc-nl
unknownNCSC-2026-0307 [1.00] [M/H] Vulnerabilities resolved in Oracle Database Productsncsc-nl
high[NEW] [HIGH] Oracle Communications: Multiple Vulnerabilitiescert-bund
high[NEW] [high] Oracle Solaris third-party components: Multiple vulnerabilitiescert-bund
high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
unknownUSN-8589-1: Apache HTTP Server vulnerabilitiesubuntu
unknownNCSC-2026-0256 [1.00] [M/H] Vulnerabilities fixed in Oracle Communicationsncsc-nl
unknownUSN-8571-1: Apache HTTP Server vulnerabilitiesubuntu
highCVE-2026-29167: Apache HTTP Server: mod_ldap per-dir use-after-freemsrc
mediumCVE-2026-44186: Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftpmsrc
highCVE-2026-34355: Apache HTTP Server: mod_proxy_html buffer overflowmsrc