CVE-2026-42356
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal…
- Risk score
- 40/100
- CVSS
- 3.7 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: fro…
- Affected
- Apache Http Server
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Apache Http Server: Red, act today. Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
The flaws
- CVE-2026-42356: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal… (CVSS 3.7 · EPSS 0%)
- CVE-2026-57941: Use-after-free (CVSS 9.8 · EPSS 1%)
- CVE-2026-56154: Use-after-free (CVSS 9.8 · EPSS 1%)
- CVE-2026-59797: Privilege escalation (CVSS 9.8 · EPSS 1%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Apache Http Server
Where it stands
- No known exploitation
Connects to
- Same product: Earlier Apache Http Server warnings. 16 in the last 90 days
Why it is Yellow
- CVSS 3.7 low
- On your watchlist: apache http server
References
Original description
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
Last activity 1 Oct 2026. Patch Forecast updates every hour.