UbuntuUpdates.org

Package "apache2-ssl-dev"

Name: apache2-ssl-dev

Description:

Apache HTTP Server (mod_ssl development headers)
Latest version: 2.4.66-2ubuntu2.7
Release: resolute (26.04)
Level: security
Repository: main
Head package: apache2
Homepage: https://httpd.apache.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "apache2-ssl-dev"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "apache2-ssl-dev" in Resolute

Repository Area Version
base main 2.4.66-2ubuntu2
updates main 2.4.66-2ubuntu2.6

Changelog

Version: 2.4.66-2ubuntu2.7 2026-11-10 01:10:47 UTC

apache2 (2.4.66-2ubuntu2.7) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-46729.patch: Validate body and query
    - CVE-2026-46729
  * SECURITY UPDATE: Information Leak
    - debian/patches/CVE-2026-47360.patch: Remove session cookie
      consistently
    - CVE-2026-47360
  * SECURITY UPDATE: Arbitrary Code Execution
    - debian/patches/CVE-2026-56153.patch: Add bounds check
    - debian/patches/CVE-2026-56449.patch: Don't dump content when
      printing a comment
    - CVE-2026-56153
    - CVE-2026-56449

 -- Bruce Cable Fri, 16 Oct 2026 12:03:06 +1100
Source diff to previous version
CVE-2026-46729 NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from
CVE-2026-47360 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookie
CVE-2026-56153 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server

Version: 2.4.66-2ubuntu2.6 2026-10-14 21:08:10 UTC

apache2 (2.4.66-2ubuntu2.6) resolute-security; urgency=medium

  * SECURITY UPDATE: Information disclosure in mod_dav_fs
    - debian/patches/CVE-2026-58415.patch: Block dav state dir in
      modules/dav/fs/mod_dav_fs.c, ../repos.c, and ../repos.h
    - CVE-2026-58415
  * SECURITY UPDATE: Improper validation in mod_proxy_ftp
    - debian/patches/CVE-2026-63045.patch: Check PASV addresses in
      modules/proxy/mod_proxy_ftp.c
    - CVE-2026-63045
  * SECURITY UPDATE: Buffer overflow in mod_vhost_alias
    - debian/patches/CVE-2026-63292.patch: Harden vhost_alias in
      modules/mappers/mod_vhost_alias.c
    - CVE-2026-63292
  * SECURITY UPDATE: NULL pointer dereference in mod_xml2enc
    - debian/patches/CVE-2026-63686.patch: Handle incomplete input in
      modules/filters/mod_xml2enc.c
    - CVE-2026-63686
  * SECURITY UPDATE: Inconsistent interpretation of HTTP Requests
    - debian/patches/CVE-2026-63718.patch: Drop hop-by-hop headers from
      UWSGI in modules/proxy/mod_proxy_uwsgi.c,
      test/modules/proxy/test_03_uwsgi.py, and
      test/modules/proxy/uwsgi_faker.py
    - CVE-2026-63718
  * SECURITY UPDATE: Authentication bypass and Use-after-free in
    mod_auth_digest
    - debian/patches/CVE-2026-7363X.patch: Stop caching the configured realm
      during config processing and always call ap_auth_name(r) to determine
      the configured realm in modules/aaa/config.m4 and ../mod_auth_digest.c
    - CVE-2026-73636
    - CVE-2026-73637
  * SECURITY UPDATE: Path equivalence vulnerability in mod_userdir
    - debian/patches/CVE-2026-79768.patch: Fix userdir check in
      modules/mappers/mod_userdir.c
    - CVE-2026-79768
  * SECURITY UPDATE: Integer overflow in mod_dav_fs
    - debian/patches/CVE-2026-93546.patch: Limit dav namespaces in
      modules/dav/fs/dbm.c and ../main/props.c
    - CVE-2026-93546

 -- Kyle Kernick Thu, 08 Oct 2026 13:55:44 -0600
Source diff to previous version
CVE-2026-58415 Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms all
CVE-2026-63045 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allow
CVE-2026-63292 Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote clien
CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend
CVE-2026-63718 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy
CVE-2026-7363 Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a san
CVE-2026-73636 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-th
CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote cl
CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard Us
CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes

Version: 2.4.66-2ubuntu2.5 2026-10-08 03:07:37 UTC

apache2 (2.4.66-2ubuntu2.5) resolute-security; urgency=medium

  * SECURITY UPDATE: Use after free in mod_rewrite.
    - debian/patches/CVE-2026-56154.patch: Copy lookahead value in
      modules/mappers/mod_rewrite.c
    - CVE-2026-56154
  * SECURITY UPDATE: Use after free in mod_http2
    - debian/patches/CVE-2026-57941.patch: Careful handling of session bbtmp
      in modules/http2/h2_c1_io.c, ../h2_mplx.c, ../h2_mplx.h,
      ../h2_session.c, and ../h2_stream.h
    - CVE-2026-57941
  * SECURITY UPDATE: Improper privilege management in mod_ssl
    - debian/patches/CVE-2026-59797.patch: Don't expose file funcs in
      modules/ssl/ssl_engine_config.c
    - CVE-2026-59797

 -- Kyle Kernick Mon, 05 Oct 2026 11:24:54 -0600
Source diff to previous version
CVE-2026-56154 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: fr
CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2
CVE-2026-59797 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache

Version: 2.4.66-2ubuntu2.4 2026-07-08 16:08:34 UTC

  apache2 (2.4.66-2ubuntu2.4) resolute-security; urgency=medium

  * SECURITY UPDATE: mod_ldap per-dir use-after-free
    - debian/patches/CVE-2026-29167.patch: Fix inheritance in per-dir context
      in modules/ldap/util_ldap.c.
    - CVE-2026-29167
  * SECURITY UPDATE: mod_proxy_ftp XSS
    - debian/patches/CVE-2026-29170.patch: Use ap_os_escape_path() with
      ap_escape_html() instead of ap_escape_uri() for href attributes in
      generated directory listing links in modules/proxy/mod_proxy_ftp.c.
    - CVE-2026-29170
  * SECURITY UPDATE: mod_proxy_html buffer overflow
    - debian/patches/CVE-2026-34355.patch: Simplify to use the ap_varbuf API
      in modules/filters/mod_proxy_html.c.
    - CVE-2026-34355
  * SECURITY UPDATE: ProxyPassReverseCookieMap buffer overflow
    - debian/patches/CVE-2026-34356.patch: fix dup path/domain in
      modules/proxy/proxy_util.c.
    - CVE-2026-34356
  * SECURITY UPDATE: mod_dav_fs protected directory access
    - debian/patches/CVE-2026-42535.patch: disallow DAV_FS_STATE_DIR in
      modules/dav/fs/repos.c.
    - CVE-2026-42535
  * SECURITY UPDATE: mod_xml2enc heap overflow
    - debian/patches/CVE-2026-42536.patch: Fix accounting in
      modules/filters/mod_xml2enc.c.
    - CVE-2026-42536
  * SECURITY UPDATE: OOB Read in 'merge_response_headers' can cause crash
    - debian/patches/CVE-2026-43951.patch: fix lang iteration in
      modules/http/http_filters.c, modules/http2/h2_c2_filter.c.
    - CVE-2026-43951
  * SECURITY UPDATE: escalation of privilege through expressions in .htaccess
    in multiple modules
    - debian/patches/CVE-2026-44119.patch: restrict per-dir file funcs
      centrally in include/ap_expr.h, modules/mappers/mod_rewrite.c,
      modules/metadata/mod_setenvif.c, modules/proxy/mod_proxy_fcgi.c,
      server/util_expr_eval.c.
    - CVE-2026-44119
  * SECURITY UPDATE: Stack Buffer Over-Read in mod_ssl OCSP 'send_request'
    - debian/patches/CVE-2026-44185.patch: Increase wbuf with the len read by
      apr_socket_send: in modules/ssl/ssl_util_ocsp.c.
    - CVE-2026-44185
  * SECURITY UPDATE: Loop in 'proxy_ftp_handler' in mod_proxy_ftp
    - debian/patches/CVE-2026-44186.patch: fix iteration in
      modules/proxy/mod_proxy_ftp.c.
    - CVE-2026-44186
  * SECURITY UPDATE: Heap Underflow in 'ap_regname' via Signed Char Overflow
    - debian/patches/CVE-2026-44631.patch: restrict to reasonable captures in
      include/ap_regex.h, modules/proxy/mod_proxy.c, server/core.c,
      server/util_pcre.c.
    - CVE-2026-44631
  * SECURITY UPDATE: mod_http2 memory corruption when file handles exhausted
    - debian/patches/CVE-2026-48913.patch: update to version 2.0.42 in
      changes-entries/h2_v2.0.40.txt, changes-entries/h2_v2.0.41.txt,
      changes-entries/h2_v2.0.42.txt, modules/http2/h2_c1_io.c,
      modules/http2/h2_c1_io.h, modules/http2/h2_config.c,
      modules/http2/h2_mplx.c, modules/http2/h2_util.c,
      modules/http2/h2_version.h.
    - debian/patches/CVE-2026-48913-2.patch: fix buffer overflow in link
      mapping in modules/http2/h2_proxy_util.c.
    - debian/patches/CVE-2026-49975.patch: removed, included in above patch.
    - CVE-2026-48913
  * Updated perl-framework tests for security changes:
    - debian/perl-framework/t/apache/expr.t
    - debian/perl-framework/t/modules/headers.t
    - https://github.com/apache/httpd-tests/commit/c45f32cd44cf15aca0253dc480fe687b2e4d76ff

 -- Marc Deslauriers <email address hidden> Mon, 06 Jul 2026 11:33:20 -0400
Source diff to previous version
CVE-2026-29167 Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 th
CVE-2026-29170 A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing F
CVE-2026-34355 A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgra
CVE-2026-34356 Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache
CVE-2026-42535 A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases
CVE-2026-42536 Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTT
CVE-2026-43951 Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP
CVE-2026-44119 Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges
CVE-2026-44185 Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP
CVE-2026-44186 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled ba
CVE-2026-44631 Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: fr
CVE-2026-48913 Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server:
CVE-2026-49975 Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. T

Version: 2.4.66-2ubuntu2.2 2026-06-04 17:07:32 UTC

  apache2 (2.4.66-2ubuntu2.2) resolute-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 Bomb denial of service
    - debian/patches/CVE-2026-49975.patch: fix cookie header accounting against
      LimitRequestFields in modules/http2/h2_util.c.
    - CVE-2026-49975

 -- Marc Deslauriers <email address hidden> Wed, 03 Jun 2026 11:25:00 -0400


About   -   Send Feedback to @ubuntu_updates