On 16 October 2026 Debian published DSA-6569-1 for apache2 in Debian 13 (trixie). It updates the web server to upstream Apache httpd 2.4.69 and fixes 19 vulnerabilities that Debian says "may result in denial of service, information disclosure, authentication bypass or HTTP request smuggling". Apache rates the most serious of them moderate. For Debian 12 (bookworm), the LTS update had not been published as of 31 October 2026.
At a glance
| Item | Details |
|---|---|
| Source package | apache2 |
| Debian 13 (trixie) | Fixed in 2.4.69-1~deb13u1 |
| Debian 12 (bookworm) | Not yet fixed: the tracker lists 2.4.68-1~deb12u1 as vulnerable; apache2 is on the LTS team's work list |
| Binary packages | apache2, apache2-bin, apache2-data, apache2-utils |
| CVEs | 19 (four rated moderate, fifteen low by Apache) |
| Severity | Medium (Apache's highest rating in this set is moderate) |
What the vulnerabilities are
Apache httpd 2.4.69 lists 20 CVEs; Debian's advisory covers 19. The one left out, CVE-2026-59685, affects Apache on Windows only. Most issues sit in optional modules, so your exposure depends on which modules you load.
Rated moderate by Apache
- CVE-2026-57941 (mod_http2): a use-after-free or wild write through session re-entrancy, affecting 2.4.17 to 2.4.68. CISA's ADP entry on cve.org scores it 9.8, much higher than Apache's own rating.
- CVE-2026-63292 (mod_vhost_alias): a stack buffer overflow from a Host header longer than 8192 bytes, which Apache says could cause a denial of service or potentially code execution. It requires
VirtualDocumentRootwith a hostname format specifier andLimitRequestFieldSizeraised above the default. - CVE-2026-42528 and CVE-2026-93546 (mod_dav, mod_dav_fs): WebDAV users with permission to create locks or write content could crash worker processes; the second can also corrupt a directory's property database.
Rated low by Apache
- Authentication: three mod_auth_digest flaws (CVE-2026-48005, CVE-2026-73636 replay, CVE-2026-73637), a mod_session cookie exposure (CVE-2026-47360), and SSLRequire file functions usable from
.htaccess(CVE-2026-59797). - Proxying: response smuggling through mod_proxy_uwsgi (CVE-2026-63718), FTP PASV handling in mod_proxy_ftp (CVE-2026-63045), and crashes in mod_proxy_html (CVE-2026-56449) and mod_xml2enc (CVE-2026-63686) from untrusted backends.
- Other modules: a limited code-execution path for some internal redirects in CGI directories (CVE-2026-42356), mod_rewrite lookahead use-after-free (CVE-2026-56154), mod_charset_lite heap overflow (CVE-2026-56153), mod_dav_fs property read access (CVE-2026-58415), mod_userdir information disclosure (CVE-2026-79768), and a mod_heartmonitor crash (CVE-2026-46729).
None of these CVEs is in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026.
Are you affected?
Check the installed version and which modules are loaded:
apt policy apache2 apache2-bin
sudo apache2ctl -M | grep -E 'http2|dav|vhost_alias|auth_digest|proxy_uwsgi|proxy_ftp|proxy_html|session|userdir|cgi'On Debian 13, anything older than 2.4.69-1~deb13u1 is affected. On Debian 12, the apache2 tracker page showed these CVEs as unfixed for bookworm on 31 October 2026. The LTS team's dla-needed.txt notes a plan to move bookworm to 2.4.69 in step with trixie, so watch debian-lts-announce. Debian 11 (bullseye) is past the end of LTS and should be upgraded.
How to update
sudo apt update
sudo apt upgradeOr update only Apache:
sudo apt install --only-upgrade apache2 apache2-bin apache2-data apache2-utilsBecause this is a new upstream release (2.4.69) rather than a small patch, test important sites on a staging copy if you can, and read the Apache 2.4 vulnerability list for details. Ubuntu packages differ; see Ubuntu Security Notices.
Restart or reboot?
No reboot is needed. Check the configuration, then restart Apache so every child process runs the new code:
sudo apache2ctl configtest
sudo systemctl restart apache2Sources
- security-tracker.debian.org/tracker/DSA-6569-1
- debian.org/security/2026/dsa-6569
- lists.debian.org/debian-security-announce/2026/msg00483.html
- httpd.apache.org/security/vulnerabilities_24.html
- cve.org/CVERecord?id=CVE-2026-57941
- cve.org/CVERecord?id=CVE-2026-63292
- security-tracker.debian.org/tracker/CVE-2026-42356
- security-tracker.debian.org/tracker/apache2
- salsa.debian.org/security-tracker-team/security-tracker/-/raw/master/data/dla-needed.txt
- packages.debian.org/source/trixie/apache2
- httpd.apache.org/docs/2.4/programs/httpd.html
- manpages.debian.org/trixie/apache2/apache2ctl.8.en.html
- lists.debian.org/debian-lts-announce
Comments
0 total · 0 threads