Description
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded.



This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published: 2026-10-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution (potential)
Action: Immediate Patch
AI Analysis

Impact

Apache HTTP Server processes Windows style 8.3 filenames and expands them during canonical‑name rewriting. When such a path is supplied, an out‑of‑bounds write occurs in the ap_directory_walk() routine, allowing an attacker to corrupt memory. This memory corruption can lead to arbitrary code execution or denial of service if triggered successfully. The weakness is a classic buffer overflow, classified as CWE‑787.

Affected Systems

Apache HTTP Server versions 2.4.0 through 2.4.68 running on Windows platforms are affected. The vulnerability is documented for all of the 2.4 series released prior to 2.4.69.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the nature of the bug—an unbounded memory write triggered by an HTTP request—suggests a high likelihood of exploitation over an open network. Attackers would need to send a specially crafted request containing a long or malformed 8.3 path. No known mitigations other than patching exist, making the risk significant for exposed servers. The CVSS score of 7.5 classifies this vulnerability as high severity.

Generated by OpenCVE AI on October 1, 2026 at 20:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.69 or later. The patch removes the vulnerable canonical‑name rewrite logic on Windows.
  • If an upgrade is not immediately possible, restrict the HTTP request parser to disallow 8.3 style filenames or enforce a stricter path parsing rule on your web server configuration.
  • Apply network‑level controls such as blocking unusual request lengths or applying the latest web application firewall rules that detect anomalous path patterns.

Generated by OpenCVE AI on October 1, 2026 at 20:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Fri, 02 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache http Server
Vendors & Products Apache
Apache http Server

Thu, 01 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Title Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
Weaknesses CWE-787
References

Subscriptions

Apache Http Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T20:09:27.502Z

Reserved: 2026-07-06T12:55:54.977Z

Link: CVE-2026-59685

cve-icon Vulnrichment

Updated: 2026-10-01T20:09:27.502Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-01T17:17:29.380

Modified: 2026-10-05T13:21:03.353

Link: CVE-2026-59685

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-01T16:07:51Z

Links: CVE-2026-59685 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T21:00:17Z

Weaknesses