Apache HTTP Server

Apache HTTP Server 2.4.69 Patches 20 Vulnerabilities Including CVSS 9.8 Issues

The Apache HTTP Server development team released version 2.4.69 on October 1, 2026, addressing a total of 20 vulnerabilities. While the Apache Security Team assessed most issues as moderate or low in impact, several vulnerabilities received CVSS base scores as high as 9.8. The update includes fixes for stack-based buffer overflows, use-after-free conditions, and out-of-bounds writes affecting multiple modules. No vulnerabilities were rated Critical or Important by the developers, with five classified as Moderate and fifteen as Low. Specific fixes cover the mod_vhost_alias, mod_http2, mod_dav, and mod_dav_fs modules, along with Windows-specific path handling problems.

CISA Adds Oracle WebLogic Proxy Plug-in Flaw CVE-2026-21962 to KEV Catalog After Confirmed Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the Oracle WebLogic Server Proxy Plug-in. The vulnerability affects the mod_wl_ohs module that proxies requests from web servers to Oracle WebLogic Server. It is bundled with Oracle HTTP Server and also impacts equivalent plug-ins for Apache HTTP Server and IIS. The flaw allows unauthenticated remote attackers to tamper with, delete, or create data and exfiltrate information. Exploitation can impact connected environments and backend systems. CISA issued the alert on August 24, 2026, highlighting the risk to organizations running affected proxy configurations.