Apache httpd 2.4.69 Fixes 20 CVEs, Moderate at Most—Update Soon

I noticed that the security page on httpd.apache.org had added entries for 2.4.69, released on 1 Oct. 2026, and counted 20 CVEs in a single release. So I went through them one by one to see which ones affect which setups, saving everyone else from having to read the entire page. The good news is that Apache rates none of them above moderate. The less good news is that there are a lot this time, and some apply to configurations found on real hosting servers.

What happened

2.4.69 is purely a security release, according to Apache's Security Reports page. All 20 entries list affected versions extending through 2.4.68. Most are memory management bugs (overflow, use-after-free, NULL pointer) in optional modules rather than the core, such as mod_dav, mod_http2, mod_vhost_alias, mod_auth_digest, and the mod_proxy_* family.

The previous release, 2.4.68 (8 Jun. 2026), had just fixed 13 CVEs (moderate 6, low 7). If you are still on 2.4.67 or older, going straight to 2.4.69 gets both sets, totaling 33 fixes, in one go. There is no need to stop at 2.4.68.

Severity

Apache assigns severity levels but does not provide CVSS scores on this page, so I have not included numbers without a source. This release has 5 moderate issues; all the rest are low. I checked CISA's KEV file released on 3 Nov. 2026 and found none of these CVEs, and none of the entries on Apache's page state that they have been exploited in the wild.

What matters is that Apache's moderate rating does not mean an issue can be ignored. These are the 5 I would check first.

The conditions for CVE-2026-63292 are fairly restrictive. It requires VirtualDocumentRoot with hostname format specifiers, and LimitRequestFieldSize must also be set above its default value. If you do not use mod_vhost_alias, the conditions do not apply. The two WebDAV issues require permission to create locks or write first; they cannot be triggered by just anyone.

Among the other 15 low issues, a few have names that sound more alarming than their severity rating.

• CVE-2026-42356 is called Limited RCE by Apache but rated low because it occurs only with certain internal redirects from a CGI program to a non-CGI file in a CGI-enabled directory, and that file must have no extension recognized by mod_mime. It affects 2.4.60 through 2.4.68.
• mod_auth_digest has three issues (CVE-2026-48005, CVE-2026-73636, CVE-2026-73637) involving forced re-authentication, credential replay, and use-after-free. All require Digest auth to be enabled and AuthDigestNcCheck or AuthDigestNonceLifetime 0 to be configured as specified for each issue.
• mod_rewrite use-after-free (CVE-2026-56154) when using the lookahead %{LA-U:HTTP:...}.
• The proxy group: mod_proxy_html (CVE-2026-56449 affects only 2.4.68), mod_proxy_ftp (CVE-2026-63045), mod_proxy_uwsgi (CVE-2026-63718, 2.4.30 through 2.4.68), and mod_xml2enc (CVE-2026-63686). All are triggered by an untrusted backend returning unusual responses.
• The rest: mod_userdir information disclosure when using an absolute UserDir without a wildcard (CVE-2026-79768), mod_ssl SSLRequire in .htaccess (CVE-2026-59797), mod_session_cookie forwarding cookies to the backend when SessionCookieRemove changes during an internal redirect (CVE-2026-47360), mod_heartmonitor (CVE-2026-46729), mod_charset_lite (CVE-2026-56153), and mod_dav_fs reading the property database (CVE-2026-58415).

Check the version and whether the conditions apply

Start with the running version, then check whether the relevant modules are loaded. If a module is not loaded, its CVEs do not apply to that machine.

# Debian / Ubuntu
apache2 -v
apt changelog apache2 | grep -oE 'CVE-2026-[0-9]+' | sort -u | head -40

# RHEL / Rocky / AlmaLinux
httpd -v
rpm -q --changelog httpd | grep -oE 'CVE-2026-[0-9]+' | sort -u | head -40

# โมดูลที่โหลดอยู่จริง
apachectl -M 2>/dev/null | grep -E '(dav|dav_fs|http2|vhost_alias|auth_digest|proxy_html|proxy_ftp|proxy_uwsgi|xml2enc|userdir)_module'

If mod_vhost_alias is present, check whether the conditions for CVE-2026-63292 apply. Search the full configuration tree (Debian uses /etc/apache2, while RHEL and DirectAdmin use /etc/httpd).

grep -RniE 'VirtualDocumentRoot|LimitRequestFieldSize|^\s*Dav\s' /etc/apache2 /etc/httpd 2>/dev/null

How to fix it

For almost every issue, Apache's page gives the brief instruction to upgrade to 2.4.69. There are no official workarounds, so I will not invent any.

1. Check the version and modules Check which httpd version is running and which modules are actually loaded.
2. Update the package Follow the procedure for your system, or rebuild if using CustomBuild.
3. Run configtest, then restart So the old child processes are replaced.
4. Check the version again Using httpd -v or the package changelog.

# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade apache2
sudo apachectl configtest && sudo systemctl restart apache2

# RHEL / Rocky / AlmaLinux
sudo dnf upgrade 'httpd*' 'mod_*'
sudo apachectl configtest && sudo systemctl restart httpd

On machines using DirectAdmin CustomBuild, update the version list first, then rebuild Apache (if configured to use Apache as the web server). Once finished, check the version using the binary installed by CustomBuild.

cd /usr/local/directadmin/custombuild
./build update
./build apache
httpd -v     # ต้องได้ 2.4.69 (ถ้าไม่อยู่ใน PATH ลอง /usr/sbin/httpd -v)

On Windows, bundles such as XAMPP often lag upstream by several months. CVE-2026-59685 occurs only on Windows. If that machine is exposed to the internet, bind Listen to 127.0.0.1 first, then find and install a release containing 2.4.69.

While waiting, a couple of precautions follow from the CVE conditions themselves (these are not Apache recommendations): do not raise LimitRequestFieldSize above the default if you use vhost_alias, and do not grant WebDAV write or lock-creation permissions to people who do not need them.

Check whether it has already been exploited

Apache has not published IOCs or request patterns for detecting exploitation of this set of issues. I can therefore only point to general signs: repeated child process crashes, which most of the memory bugs on this list can cause.

grep -E 'exit signal (Segmentation fault|Aborted|Bus error)' \
  /var/log/apache2/error.log* /var/log/httpd/error_log* 2>/dev/null | tail -20

If these occur frequently and coincide with unusual requests to WebDAV or abnormally long Host headers, investigate further. If they do not appear, that does not mean the machine has not been affected, because logs like these are not conclusive evidence. For a broader check of the machine, see Debian server security scan.

Personally, I see none that would make me get up to patch at three in the morning, because none has a high CVSS score and none is in KEV. But I would not defer this past the next maintenance window, because 20 issues in one release is too many to keep accumulating. I would handle machines that allow users to write through WebDAV or use mod_vhost_alias first. The rest can go through the normal maintenance cycle, according to the staffing available at each site.

P.S. Apache's Security Reports page has lines where the starting version number is missing in some entries (such as a few for 2.4.68), so I have used only ranges that the page prints in full.

Sources: Apache HTTP Server Project, Security Reports 2.4 (https://httpd.apache.org/security/vulnerabilities_24.html), CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Information current as of 5 Nov. 2026; KEV checked against the file CISA released on 3 Nov. 2026. I will come back and update this later.