CVE-2026-42536

What it actually does

CVE-2026-42536 is a remotely reachable heap-based buffer overflow in Apache HTTP Server when mod_xml2enc processes untrusted content via xml2StartParse. A remote unauthenticated attacker can trigger memory corruption by sending crafted content to a vulnerable server path that invokes mod_xml2enc. The published CVSS vector indicates network access, low attack complexity, no required privileges, and no user interaction, with primary impact to availability. The expected practical outcome is process crash or denial of service of affected Apache worker processes; the advisory does not indicate confirmed confidentiality or integrity impact.

Why it matters to the business

Organizations running Apache HTTP Server 2.4.0 through 2.4.67 with mod_xml2enc exposed to untrusted input may experience web service instability or outages if the flaw is triggered. Public exploit maturity is currently listed as none, EPSS is low and stable, and the issue is not in the CISA KEV catalog, but Apache HTTP Server is widely deployed, so exposed internet-facing systems should still be patched in a normal-to-expedited maintenance window to reduce denial-of-service risk.

How an attack unfolds

An attacker first identifies an Apache HTTP Server instance running a vulnerable 2.4.x version and determines whether request handling reaches mod_xml2enc for attacker-controlled content. The attacker then sends specially crafted HTTP content intended to exercise the vulnerable XML encoding parsing path in xml2StartParse. If the crafted input corrupts heap memory, the affected Apache process may terminate abnormally, causing failed requests, worker exhaustion, service degradation, or a full outage depending on MPM configuration, process supervision, request volume, and restart behavior. There is no current evidence from the provided data of active exploitation, ransomware use, or named threat actor activity.

How to fix it

Upgrade Apache HTTP Server to version 2.4.68 or later. Prioritize internet-facing servers and any deployment where mod_xml2enc is enabled or where untrusted XML or encoded content is processed. If immediate upgrade is not possible, reduce exposure by disabling mod_xml2enc where it is not required, restricting access to affected endpoints, applying upstream reverse-proxy or WAF filtering for suspicious malformed XML/encoding payloads, and ensuring Apache process supervision restarts failed workers. Treat mitigations as temporary because they may not cover all vulnerable parsing paths.

How to confirm the fix worked

Confirm all Apache HTTP Server installations report version 2.4.68 or later using package inventory, configuration management, or the httpd/apachectl version command. Review loaded modules with commands such as httpd -M or apachectl -M and verify whether xml2enc_module is enabled. Confirm vendor packages have been updated and restarted, not merely installed. For source-built deployments, validate the running binary path and build version. Where external version banners are suppressed, validate internally rather than relying only on remote scanning. After patching, monitor error logs for continued segmentation faults, aborted workers, or repeated malformed XML requests.

Typical attack path

1. Scan for internet-accessible Apache HTTP Server instances and infer vulnerable 2.4.x versions where possible.
2. Identify endpoints, content types, or application flows that cause Apache to invoke mod_xml2enc on untrusted content.
3. Send crafted XML or encoded content over HTTP to trigger the vulnerable parsing path.
4. Cause heap memory corruption in the Apache worker process.
5. Repeat requests as needed to crash workers, exhaust capacity, or create a denial-of-service condition.

How to detect it

To determine whether exploitation may already have occurred, review Apache access logs, error logs, system logs, core dump locations, and process supervision logs for abnormal worker crashes correlated with suspicious HTTP requests carrying malformed XML, unusual character encodings, or unexpected content transformation behavior. Focus on time windows with spikes in 5xx responses, connection resets, child process exits, segmentation faults, aborted processes, or core dumps. Useful sources include Apache error_log and access_log, journald/syslog, systemd service logs, container stdout/stderr, kernel crash messages, coredumpctl, WAF logs, reverse-proxy logs, EDR process telemetry, and load balancer health-check records. Because no unique public exploit string is provided, treat the listed artifacts as suspicious indicators requiring correlation rather than definitive proof of exploitation.

• mod_xml2enc
• xml2StartParse
• xml2enc_module
• Segmentation fault
• segfault
• exit signal Segmentation fault
• exit signal Aborted
• core dumped
• AH00052: child pid
• AH00484: server reached MaxRequestWorkers setting
• coredumpctl httpd
• coredumpctl apache2
• /var/log/httpd/error_log
• /var/log/apache2/error.log
• /var/lib/systemd/coredump/
• /var/crash/
• httpd: segfault
• apache2: segfault

What your security team should do

• Inventory Apache HTTP Server deployments and identify versions 2.4.0 through 2.4.67.
• Prioritize upgrade to Apache HTTP Server 2.4.68 or later for internet-facing and business-critical systems.
• Identify where mod_xml2enc is loaded and disable it if not required.
• Review exposure of endpoints that accept XML, encoded, or transformed content from untrusted users.
• Add temporary monitoring for Apache worker crashes, segmentation faults, and bursts of malformed XML requests until patching is complete.
• Ensure service managers and load balancers detect failed Apache workers and remove unhealthy nodes quickly.
• After remediation, verify the running service version and module state, not only the installed package version.