Patch Forecast
Amber warning
Patch this week.

CVE-2026-63686

Apache Http Server: null pointer dereference can lead to denial of service

Risk score
68/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.5%
Published
1 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4…
Affected
Apache Http Server before 2.4.69
Fix
Upgrade Apache Http Server to 2.4.69 or later.
Exploitation
No known exploitation

Story map

Story map: Apache Http ServerTHE FLAWSTHE FIXCVE-2026-63686Null pointer dereference canlead to denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-57941Use-after-freeCVSS 9.8 · EPSS 1%CVE-2026-56154Use-after-freeCVSS 9.8 · EPSS 1%CVE-2026-59797Privilege escalationCVSS 9.8 · EPSS 1%Upgrade Apache Http Server2.4.69or later on your release lineWho is exposedApache Http ServerRED · ACT TODAYApache HttpServerUse After Free vulnerability inApache HTTP Server'smod_http2 via sharedsession->bbtmp re-entrancyThis issue affects Apache HTTPServer: from 2.4.0 through2.4.68.Where it standsNo known exploitationCONNECTS TOSame weaknessNull pointer dereference (CWE-476)91 other warnings in 30 days →Same productEarlier Apache Http Server warnings16 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Http Server: Red, act today. Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

The flaws

The fix

Upgrade Apache Http Server: 2.4.69 or later on your release line

Who is exposed: Apache Http Server

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: apache http server

References

Original description

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Last activity 1 Oct 2026. Patch Forecast updates every hour.