USN-8571-2: Apache HTTP Server regression
USN-8571-1 fixed vulnerabilities in Apache HTTP Server. That fix was incomplete due to a missing library symbol, resulting in a regression that could cause Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in mod_authn_socache. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33007) Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apache HTTP Server had an HTTP response splitting vulnerability in multiple modules when used with untrusted or compromised backend servers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-33523) Elhanan Haenel discovered that Apache HTTP Server incorrectly handled certain memory operations in mod_proxy_ajp. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33857) Tianshuo Han and Jérôme Djouder discovered that Apache HTTP Server incorrectly handled certain string operations in mod_proxy_ajp. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-34032) It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-34355) It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-34356) It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535) It was dis
Details
Original advisory: https://ubuntu.com/security/notices/USN-8571-2
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-330070.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-335230.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-338570.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-340320.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-343551.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-343560.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-425350.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-425361.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-439510.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-441190.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-33007 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-33523 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-33857 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-34032 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-34355 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-34356 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-42535 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-42536 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-43951 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-44119 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-44185 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-44186 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-44631 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48913 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [hoch] Apache HTTP Server: Mehrere Schwachstellencert-bund
- high[UPDATE] [hoch] Apache HTTP Server: Mehrere Schwachstellencert-bund
- high[NEW] [high] Oracle Solaris third-party components: Multiple vulnerabilitiescert-bund
- mediumCVE-2026-33523: Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status linemsrc
- mediumCVE-2026-33007: Apache HTTP Server: mod_authn_socache crashmsrc
- mediumCVE-2026-34032: Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check…msrc
- mediumCVE-2026-33857: Apache HTTP Server: Off-by-one OOB reads in AJP getter functionsmsrc
- unknownMultiple vulnerabilities in Tenable products (August 4, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in Tenable Security Center (July 21, 2026)cert-fr-avis
- unknownUSN-8571-1: Apache HTTP Server vulnerabilitiesubuntu
- unknownUSN-8516-1: Apache HTTP Server vulnerabilitiesubuntu
- mediumCVE-2026-43951: Apache HTTP Server: OOB Read in `merge_response_headers` can cause crashmsrc
More from Ubuntu Security Notices
- unknownUSN-8747-1: Beets vulnerability2026-09-10
- unknownUSN-8746-1: libEBML vulnerability2026-09-10
- unknownUSN-8745-1: KissFFT vulnerabilities2026-09-10
- unknownUSN-8748-1: Linux kernel (NVIDIA) vulnerabilities2026-09-10
- unknownUSN-8744-1: Python vulnerabilities2026-09-10