Apache HTTP Server 2.4.68 fixes 13 CVEs in proxy, DAV and HTTP/2

In the first week of June 2026 the Apache HTTP Server project released 2.4.68, fixing 13 CVEs. None is rated higher than moderate, and most live in optional modules such as mod_proxy_html, mod_proxy_ftp, mod_dav_fs and mod_http2. Your exposure depends on which modules you load.

What's affected

All 13 affect 2.4.67 and earlier (some ranges start later). Fixed in 2.4.68. The moderate ones:

• CVE-2026-34355, mod_proxy_html: buffer overflow triggered by an untrusted backend.
• CVE-2026-42535, mod_dav_fs: path handling lets a WebDAV author manipulate trusted DAV property databases and crash children.
• CVE-2026-43951, core (mod_headers, mod_mime): out of bounds read in merge_response_headers with multiple response languages.
• CVE-2026-44119, .htaccess expressions: local .htaccess authors can read files with the httpd user's privileges.
• CVE-2026-44186, mod_proxy_ftp: infinite loop with an attacker controlled FTP backend.
• CVE-2026-49975, mod_http2: excessive memory allocation leading to denial of service (2.4.17 to 2.4.67).

The low severity entries include a mod_http2 use after free when file handles run out (CVE-2026-48913), mod_ldap, mod_ssl OCSP, mod_xml2enc and mod_proxy cookie rewriting.

How to check if you're exposed

List the modules actually loaded and the version:

httpd -v
apachectl -M 2>/dev/null | grep -E "proxy_html|proxy_ftp|dav_fs|http2|ldap|xml2enc|headers|mime"
grep -rn "AllowOverride" /etc/httpd /etc/apache2 2>/dev/null

Then match: no proxy_ftp loaded means the two FTP CVEs are not reachable. No dav_fs means the DAV one is not. AllowOverride None closes the .htaccess path.

What to do now

1. Upgrade to 2.4.68 or later through your distribution or build. Distributions often backport, so check the package changelog for the CVE IDs, not just the version string.
2. Disable modules you do not use (a2dismod proxy_ftp, or remove the LoadModule line).
3. Prioritize anything with mod_http2 on the public edge, then reverse proxies that forward to backends you do not fully control.

How this could have been avoided

• Load only the modules you need. Ten of the thirteen sit in optional modules. An unloaded module has no attack surface.
• Do not proxy to backends you do not trust. The mod_proxy_html and mod_proxy_ftp bugs need a hostile upstream. Pin upstreams to your own services.
• Set AllowOverride None where you can. It removes the .htaccess author as an attacker.

Why it matters

A bundle of 13 low and moderate CVEs rarely makes the news, and it is easy to let it age. The version is the cheap part to fix. The useful work is knowing which modules you run, which is also the answer reachability analysis would give: the vulnerable code is only a risk if your configuration calls it.

Quick check

Sources

• Apache HTTP Server 2.4 vulnerabilities