CVE-2026-24072
High · 8.8CVSS
8.8
EPSS
0.7%
Published
May 4, 2026
CISA due date
—
The record
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.66-160000.2.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.67-1.1 |
Related vulnerabilities
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2
- CVE-2026-33007 A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and… Also affects apache2
- CVE-2026-33523 HTTP response splitting vulnerability in multiple Apache HTTP Server modules with… Also affects apache2
- CVE-2026-23918 Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. Also affects apache2
- CVE-2026-29169 A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may… Also affects apache2
- CVE-2026-33006 A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of… Also affects apache2
- CVE-2026-33857 Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2