SUSE-SU-2026:5099-1: important: Security update for apache2
SLE-SECURITY-UPDATES
null at suse.de
Thu Nov 5 08:31:22 UTC 2026
# Security update for apache2
Announcement ID: SUSE-SU-2026:5099-1
Release Date: 2026-11-04T17:55:20Z
Rating: important
References:
* bsc#1284043
* bsc#1284044
* bsc#1284045
* bsc#1284046
* bsc#1284047
* bsc#1284048
* bsc#1284049
* bsc#1284050
* bsc#1284051
* bsc#1284053
* bsc#1284054
* bsc#1284055
* bsc#1284056
* bsc#1284057
* bsc#1284058
* bsc#1284059
* bsc#1284060
* bsc#1284061
Cross-References:
* CVE-2026-42356
* CVE-2026-42528
* CVE-2026-46729
* CVE-2026-47360
* CVE-2026-48005
* CVE-2026-56153
* CVE-2026-56154
* CVE-2026-57941
* CVE-2026-58415
* CVE-2026-59797
* CVE-2026-63045
* CVE-2026-63292
* CVE-2026-63686
* CVE-2026-63718
* CVE-2026-73636
* CVE-2026-73637
* CVE-2026-79768
* CVE-2026-93546
CVSS scores:
* CVE-2026-42356 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-42356 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-42356 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-42528 ( SUSE ): 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-42528 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-42528 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-46729 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-46729 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-46729 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-47360 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-47360 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-47360 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-48005 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-48005 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48005 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56153 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-56153 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-56153 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-56154 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-56154 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-56154 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-57941 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-57941 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-57941 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-58415 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-58415 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-58415 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-59797 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-59797 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-59797 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-63045 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-63045 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-63045 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-63292 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-63292 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-63292 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63686 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-63686 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63686 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63718 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-63718 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-63718 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-73636 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-73636 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-73636 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-73637 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-73637 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
* CVE-2026-73637 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-79768 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-79768 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-79768 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-93546 ( SUSE ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2026-93546 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
* CVE-2026-93546 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* SUSE Linux Enterprise High Performance Computing 12 SP5
* SUSE Linux Enterprise Server 12 SP5
* SUSE Linux Enterprise Server 12 SP5 LTSS
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
* SUSE Linux Enterprise Server for SAP Applications 12 SP5
An update that solves 18 vulnerabilities can now be installed.
## Description:
This update for apache2 fixes the following issues:
* CVE-2026-42356: deployment of wrong handler allows target of internal
redirects from CGI programs to also be treated as CGI and executed
(bsc#1284043).
* CVE-2026-42528: memory calculation bug in `mod_dav` allows an attacker with
permission to create WebDAV locks to crash server child processes
(bsc#1284044).
* CVE-2026-46729: NULL pointer dereference in `mod_heartmonitor` over unicast
listener (bsc#1284045).
* CVE-2026-47360: session cookie passed to a backend server when
`SessionCookieRemove` changes across internal redirects (bsc#1284046).
* CVE-2026-48005: missing authentication checks in `mod_auth_digest` allows an
unauthenticated remote client to cause a DoS via forged `Authorization`
headers when Digest authentication is enabled with `AuthDigestNcCheck`
(bsc#1284047).
* CVE-2026-56153: out-of-bounds write in `mod_charset_lite` (bsc#1284048).
* CVE-2026-56154: use-after-free in `mod_rewrite` when using lookahead
`(%{LA-U:HTTP:...})` (bsc#1284049).
* CVE-2026-57941: use-after-free in `mod_http2` via shared `session->bbtmp`
re-entrancy (bsc#1284050).
* CVE-2026-58415: internal state files accessible to external parties in
`mod_dav_fs` allows a remote client to read WebDAV dead properties of
resources it cannot author via a GET request for the .DAV state directory
(bsc#1284051).
* CVE-2026-59797: improper privilege management in `mod_ssl` when using
`SSLRequire` and file-related expressions (bsc#1284059).
* CVE-2026-63045: improper validation of FTP PASV reply address in
`mod_proxy_ftp` allows an untrusted FTP server to cause a proxy to open a
data connection to an arbitrary third-party host (bsc#1284060).
* CVE-2026-63292: stack-based buffer overflow in `mod_vhost_alias` allows a
remote client to cause a DoS or potentially execute arbitrary code via an
HTTP request with a specially crafted `Host` header (bsc#1284061).
* CVE-2026-63686: NULL pointer dereference in `mod_xml2enc` allows an
untrusted backend server to cause a denial of service via a crafted proxied
response (bsc#1284058).
* CVE-2026-63718: inconsistent interpretation of HTTP requests in
`mod_proxy_uwsgi` allows for response smuggling via a crafted uwsgi response
with `Transfer-Encoding` (bsc#1284057).
* CVE-2026-73636: authentication bypass by capture-replay in `mod_auth_digest`
allows a MiTM attacker to replay captured digest authentication credentials
via crafted requests (bsc#1284056).
* CVE-2026-73637: use-after-free in `mod_auth_digest` allows an
unauthenticated remote client to cause authentication state corruption via
concurrent Digest authentication requests (bsc#1284055).
* CVE-2026-79768: path equivalence issue in the `mod_userdir` module when
configured with absolute non-wildcard `UserDir` directive (bsc#1284054).
* CVE-2026-93546: integer overflow in `mod_dav_fs` allows an authenticated
WebDAV client with write access to crash worker processes and persistently
corrupt a directory's property database (bsc#1284053).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 12 SP5 LTSS
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-5099
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-5099
## Package List:
* SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* apache2-debugsource-2.4.66-35.84.1
* apache2-worker-debuginfo-2.4.66-35.84.1
* apache2-worker-2.4.66-35.84.1
* apache2-2.4.66-35.84.1
* apache2-tls13-debugsource-2.4.66-35.84.1
* apache2-tls13-prefork-debuginfo-2.4.66-35.84.1
* apache2-utils-debuginfo-2.4.66-35.84.1
* apache2-tls13-worker-debuginfo-2.4.66-35.84.1
* apache2-devel-2.4.66-35.84.1
* apache2-tls13-utils-debuginfo-2.4.66-35.84.1
* apache2-tls13-debuginfo-2.4.66-35.84.1
* apache2-tls13-worker-2.4.66-35.84.1
* apache2-tls13-example-pages-2.4.66-35.84.1
* apache2-debuginfo-2.4.66-35.84.1
* apache2-tls13-devel-2.4.66-35.84.1
* apache2-utils-2.4.66-35.84.1
* apache2-prefork-2.4.66-35.84.1
* apache2-prefork-debuginfo-2.4.66-35.84.1
* apache2-tls13-prefork-2.4.66-35.84.1
* apache2-tls13-2.4.66-35.84.1
* apache2-tls13-utils-2.4.66-35.84.1
* apache2-example-pages-2.4.66-35.84.1
* SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
* apache2-doc-2.4.66-35.84.1
* apache2-tls13-doc-2.4.66-35.84.1
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
* apache2-debugsource-2.4.66-35.84.1
* apache2-worker-debuginfo-2.4.66-35.84.1
* apache2-worker-2.4.66-35.84.1
* apache2-2.4.66-35.84.1
* apache2-tls13-debugsource-2.4.66-35.84.1
* apache2-tls13-prefork-debuginfo-2.4.66-35.84.1
* apache2-utils-debuginfo-2.4.66-35.84.1
* apache2-tls13-worker-debuginfo-2.4.66-35.84.1
* apache2-devel-2.4.66-35.84.1
* apache2-tls13-utils-debuginfo-2.4.66-35.84.1
* apache2-tls13-debuginfo-2.4.66-35.84.1
* apache2-tls13-worker-2.4.66-35.84.1
* apache2-tls13-example-pages-2.4.66-35.84.1
* apache2-debuginfo-2.4.66-35.84.1
* apache2-tls13-devel-2.4.66-35.84.1
* apache2-utils-2.4.66-35.84.1
* apache2-prefork-2.4.66-35.84.1
* apache2-prefork-debuginfo-2.4.66-35.84.1
* apache2-tls13-prefork-2.4.66-35.84.1
* apache2-tls13-2.4.66-35.84.1
* apache2-tls13-utils-2.4.66-35.84.1
* apache2-example-pages-2.4.66-35.84.1
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
* apache2-doc-2.4.66-35.84.1
* apache2-tls13-doc-2.4.66-35.84.1
## References:
* https://www.suse.com/security/cve/CVE-2026-42356.html
* https://www.suse.com/security/cve/CVE-2026-42528.html
* https://www.suse.com/security/cve/CVE-2026-46729.html
* https://www.suse.com/security/cve/CVE-2026-47360.html
* https://www.suse.com/security/cve/CVE-2026-48005.html
* https://www.suse.com/security/cve/CVE-2026-56153.html
* https://www.suse.com/security/cve/CVE-2026-56154.html
* https://www.suse.com/security/cve/CVE-2026-57941.html
* https://www.suse.com/security/cve/CVE-2026-58415.html
* https://www.suse.com/security/cve/CVE-2026-59797.html
* https://www.suse.com/security/cve/CVE-2026-63045.html
* https://www.suse.com/security/cve/CVE-2026-63292.html
* https://www.suse.com/security/cve/CVE-2026-63686.html
* https://www.suse.com/security/cve/CVE-2026-63718.html
* https://www.suse.com/security/cve/CVE-2026-73636.html
* https://www.suse.com/security/cve/CVE-2026-73637.html
* https://www.suse.com/security/cve/CVE-2026-79768.html
* https://www.suse.com/security/cve/CVE-2026-93546.html
* https://bugzilla.suse.com/show_bug.cgi?id=1284043
* https://bugzilla.suse.com/show_bug.cgi?id=1284044
* https://bugzilla.suse.com/show_bug.cgi?id=1284045
* https://bugzilla.suse.com/show_bug.cgi?id=1284046
* https://bugzilla.suse.com/show_bug.cgi?id=1284047
* https://bugzilla.suse.com/show_bug.cgi?id=1284048
* https://bugzilla.suse.com/show_bug.cgi?id=1284049
* https://bugzilla.suse.com/show_bug.cgi?id=1284050
* https://bugzilla.suse.com/show_bug.cgi?id=1284051
* https://bugzilla.suse.com/show_bug.cgi?id=1284053
* https://bugzilla.suse.com/show_bug.cgi?id=1284054
* https://bugzilla.suse.com/show_bug.cgi?id=1284055
* https://bugzilla.suse.com/show_bug.cgi?id=1284056
* https://bugzilla.suse.com/show_bug.cgi?id=1284057
* https://bugzilla.suse.com/show_bug.cgi?id=1284058
* https://bugzilla.suse.com/show_bug.cgi?id=1284059
* https://bugzilla.suse.com/show_bug.cgi?id=1284060
* https://bugzilla.suse.com/show_bug.cgi?id=1284061
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261105/31192d03/attachment.htm>
More information about the sle-security-updates
mailing list