CVE-2026-44631
A critical buffer underwrite flaw exists in Apache HTTP Server when processing crafted regular expressions in its configuration. The vulnerability can allow an attacker to read or modify memory, potentially taking control of the server. It affects all versions from 2.4.0 through 2.4.67.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache HTTP Server 2.4.0 through 2.4.67, used by web servers worldwide.
Real-world impact
An attacker could read or alter memory, leading to arbitrary code execution, data theft, or denial of service on the affected web server.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network with no authentication, and can compromise confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade Apache HTTP Server to version 2.4.68 or later.
- 022. Restart the Apache service.
NVD-referenced vendor advisory
Timeline
- Jun 8, 2026 · Jun 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- httpd.apache.org/security/vulnerabilities_24…vendor advisory
- openwall.com/lists/oss-security/2026/06/…mailing listthird party advisory