USN-9090-1: Apache HTTP Server vulnerabilities
Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42528) It was discovered that Apache HTTP Server's mod_vhost_alias module incorrectly handled certain requests, leading to a one-byte stack buffer overflow. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-109163) It was discovered that Apache HTTP Server's mod_md module incorrectly handled certain conditions, leading to a NULL pointer dereference. An attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-1
Continue on Ubuntu Security Notices ↗ ‹ All news Get the newsletter
The summary and image come from Ubuntu Security Notices; the image is shown from their website.