SKYLINE Blog

Security advisory Debian

Apache HTTP Server DSA-6248-1 and DSA-6323-1 (May-June 2026): httpd 2.4.67, HTTP/2 double free and DoS fixes

DSA-6248-1 moved Debian 12 and 13 to Apache httpd 2.4.67, fixing an important HTTP/2 double free and ten more CVEs; DSA-6323-1 added an HTTP/2 DoS fix in June.

Published
Reading time
4 min read

Security advisory Vulnerability

Severity: High Status: Patched
CVE IDs
Status
Fixed versions are available for Debian 13 (trixie) and Debian 12 (bookworm).
Affected
  • apache2 in Debian 13 (trixie) before 2.4.67-1~deb13u2
  • apache2 in Debian 12 (bookworm) before 2.4.67-1~deb12u2
  • apache2 in Debian 13 (trixie) before 2.4.67-1~deb13u3
  • apache2 in Debian 12 (bookworm) before 2.4.67-1~deb12u3
Published
Updated

What you should do

  • Upgrade Apache to the newest package for your release and restart it.
  • On shared servers where several users edit .htaccess, treat CVE-2026-24072 as important to fix.
  • If you rely on Digest authentication, plan a move to a stronger method behind TLS.
  • Disable modules you do not use, such as proxy_ajp or dav_lock, with a2dismod.
Timeline
  1. Debian published DSA-6248-1 for apache2.
  2. Debian published DSA-6323-1 for apache2.
  3. Skyline published this summary.

On 6 May 2026 Debian published DSA-6248-1, updating apache2 in Debian 12 (bookworm) and Debian 13 (trixie) to upstream Apache httpd 2.4.67. Debian says the fixed issues "may result in remote code execution, privilege escalation, denial of service or information disclosure". A month later, on 6 June, DSA-6323-1 fixed a further HTTP/2 denial-of-service bug. Both releases were still under regular security support at the time, so both received DSAs.

At a glance

AdvisoryDateDebian 13 (trixie)Debian 12 (bookworm)CVEs
DSA-6248-16 May 20262.4.67-1~deb13u22.4.67-1~deb12u211 in the announcement, including CVE-2026-23918 (Apache: important)
DSA-6323-16 Jun 20262.4.67-1~deb13u32.4.67-1~deb12u3CVE-2026-49975 (Apache: moderate)

Binary packages to check: apache2, apache2-bin, apache2-data, apache2-utils. Severity: High, based on Apache's "important" rating for CVE-2026-23918.

What was fixed

DSA-6248-1 (httpd 2.4.67)

  • CVE-2026-23918, HTTP/2 double free (important). Apache describes a double free and possible remote code execution in the HTTP/2 protocol on early stream reset, affecting 2.4.66 only. Debian notes that trixie already received this fix in the Debian 13.4 point release (2.4.66-1~deb13u2); bookworm got it with DSA-6248-1.
  • CVE-2026-24072, privilege escalation through .htaccess expressions (moderate). Local .htaccess authors could read files with the privileges of the web server user. This matters on servers where several users or sites can write .htaccess files.
  • CVE-2026-33006, mod_auth_digest timing attack (moderate). A remote attacker could bypass Digest authentication.
  • Low-rated issues: four mod_proxy_ajp memory errors (CVE-2026-28780, CVE-2026-33857, CVE-2026-34032, CVE-2026-34059), HTTP response splitting with untrusted backends (CVE-2026-33523), unrestricted OCSP response data in mod_md (CVE-2026-29168), and crashes in mod_dav_lock (CVE-2026-29169) and mod_authn_socache (CVE-2026-33007).

DSA-6323-1

  • CVE-2026-49975 (moderate). Incorrect cookie header accounting in the HTTP/2 implementation could lead to excessive resource use and denial of service. CISA's assessment on cve.org records a public proof of concept.

None of these CVEs is in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026.

What came after

Apache httpd 2.4.68 (June 2026, 13 CVEs) later reached Debian as 2.4.68-1~deb12u1 and 2.4.68-1~deb13u1 through the regular stable archive rather than a DSA. In October, trixie moved to 2.4.69 with DSA-6569-1 (2.4.69-1~deb13u1), while the matching bookworm update was still pending with the LTS team on 31 October 2026. Each package includes all earlier fixes, so the newest version for your release is always the one to run.

Are you affected?

apt policy apache2 apache2-bin
sudo apache2ctl -M | grep -E 'http2|auth_digest|proxy_ajp|md_module|dav_lock|authn_socache'

Any bookworm version below 2.4.67-1~deb12u3, or trixie version below 2.4.67-1~deb13u3, misses fixes from these two advisories. If HTTP/2 (http2_module) is loaded, the HTTP/2 issues apply to you. Debian 11 (bullseye) is past the end of LTS and should be upgraded.

How to update

sudo apt update
sudo apt upgrade

Make sure your sources include both the main suite and the security suite (bookworm and bookworm-security, or trixie and trixie-security), because some Apache fixes reached Debian through the main archive. Ubuntu packages differ; see Ubuntu Security Notices.

Restart or reboot?

No reboot is needed. Check the configuration and restart Apache:

sudo apache2ctl configtest
sudo systemctl restart apache2

Sources

Topics

SKYLINE Engineering

@skyline

The engineering team at SKYLINE Industrial Solutions. We publish field-tested guides drawn from real KSA and GCC deployments.

See author profile
More in Debian

Related: Skyline Nexus ERP guides

Nexus knowledge base →
Skyline Nexus ERP

Gulf & Middle East tax and e-invoicing guides

VAT, ZATCA e-invoicing and corporate tax explained for Saudi Arabia, the UAE and the wider GCC.

 Skyline Nexus ERP

Skyline Nexus ERP — cloud accounting & ZATCA e-invoicing

Our cloud ERP: accounting, invoicing, inventory and POS in one place. First month free.
SKYLINE engineering services

Need this implemented for you?

Reading is free — building it right takes a team. SKYLINE engineers ship Debian for Aramco vendors, banks, hospitals and government agencies across Saudi Arabia. Talk to us before you start.

Server Infrastructure Dell, HPE, Huawei, VMware, Hyper-V, HCI IT AMC Annual maintenance, 24/7 SLA, Bronze→Platinum
Talk to a SKYLINE engineer Call +966 50 993 9334
Aramco Approved Contractor ISO 9001 · ISO 27001 SAMA CSF aligned NCA ECC ready 247+ KSA clients

Comments

0 total · 0 threads
Be the first to leave a comment.