Vulnerability-Lookup

RHSA-2026:89860

Vulnerability from csaf_opensuse - Published: 2026-10-26 00:00 - Updated: 2026-10-27 21:00

Summary

security update for httpd

Severity

Important

Notes

Title of the patch: security update for httpd

Description of the patch: This security update provides a functional equivalent of RHSA-2026:89860. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:89860.

Patchnames: RHSA-2026:89860

CVE-2026-46729

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 11 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-48005

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-56153

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-56154

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-63045

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-63292

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-63686

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-63718

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-73636

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-73637

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

CVE-2026-93546

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 11 products, the same list as for CVE-2026-46729

Threats

Impact important

References

37 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-46729/	self
https://www.suse.com/security/cve/CVE-2026-48005/	self
https://www.suse.com/security/cve/CVE-2026-56153/	self
https://www.suse.com/security/cve/CVE-2026-56154/	self
https://www.suse.com/security/cve/CVE-2026-63045/	self
https://www.suse.com/security/cve/CVE-2026-63292/	self
https://www.suse.com/security/cve/CVE-2026-63686/	self
https://www.suse.com/security/cve/CVE-2026-63718/	self
https://www.suse.com/security/cve/CVE-2026-73636/	self
https://www.suse.com/security/cve/CVE-2026-73637/	self
https://www.suse.com/security/cve/CVE-2026-93546/	self
https://www.suse.com/security/cve/CVE-2026-46729	external
https://bugzilla.suse.com/1284045	external
https://www.suse.com/security/cve/CVE-2026-48005	external
https://bugzilla.suse.com/1284047	external
https://www.suse.com/security/cve/CVE-2026-56153	external
https://bugzilla.suse.com/1284048	external
https://www.suse.com/security/cve/CVE-2026-56154	external
https://bugzilla.suse.com/1284049	external
https://www.suse.com/security/cve/CVE-2026-63045	external
https://bugzilla.suse.com/1284060	external
https://www.suse.com/security/cve/CVE-2026-63292	external
https://bugzilla.suse.com/1284061	external
https://www.suse.com/security/cve/CVE-2026-63686	external
https://bugzilla.suse.com/1284058	external
https://www.suse.com/security/cve/CVE-2026-63718	external
https://bugzilla.suse.com/1284057	external
https://www.suse.com/security/cve/CVE-2026-73636	external
https://bugzilla.suse.com/1284056	external
https://www.suse.com/security/cve/CVE-2026-73637	external
https://bugzilla.suse.com/1284055	external
https://www.suse.com/security/cve/CVE-2026-93546	external
https://bugzilla.suse.com/1284053	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for httpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:89860.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:89860.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:89860",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_89860.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:89860",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008406.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:89860",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008406.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46729 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46729/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48005 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48005/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56153 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56153/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56154 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56154/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63045 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63045/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63292 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63292/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63686 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63686/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63718 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63718/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-73636 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-73636/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-73637 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-73637/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-93546 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-93546/"
      }
    ],
    "title": "security update for httpd",
    "tracking": {
      "current_release_date": "2026-10-27T21:00:11Z",
      "generator": {
        "date": "2026-10-26T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:89860",
      "initial_release_date": "2026-10-26T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-26T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-26T19:16:52Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-27T21:00:11Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
                "product": {
                  "name": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
                  "product_id": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-filesystem@2.4.63-13.el10_2.8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
                "product": {
                  "name": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
                  "product_id": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-manual@2.4.63-13.el10_2.8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "httpd-0:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "httpd-0:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd@2.4.63-13.el10_2.8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-core@2.4.63-13.el10_2.8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-devel@2.4.63-13.el10_2.8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-tools@2.4.63-13.el10_2.8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_ldap@2.4.63-13.el10_2.8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_lua@2.4.63-13.el10_2.8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_proxy_html@2.4.63-13.el10_2.8?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_session@2.4.63-13.el10_2.8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
                "product": {
                  "name": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
                  "product_id": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_ssl@2.4.63-13.el10_2.8?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 10",
                "product": {
                  "name": "SUSE Liberty Linux 10",
                  "product_id": "SUSE Liberty Linux 10",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "httpd-0:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch"
        },
        "product_reference": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-manual-0:2.4.63-13.el10_2.8.noarch as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch"
        },
        "product_reference": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        },
        "product_reference": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46729",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46729"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46729",
          "url": "https://www.suse.com/security/cve/CVE-2026-46729"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284045 for CVE-2026-46729",
          "url": "https://bugzilla.suse.com/1284045"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46729"
    },
    {
      "cve": "CVE-2026-48005",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48005"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48005",
          "url": "https://www.suse.com/security/cve/CVE-2026-48005"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284047 for CVE-2026-48005",
          "url": "https://bugzilla.suse.com/1284047"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-48005"
    },
    {
      "cve": "CVE-2026-56153",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56153"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Out-of-bounds Write vulnerability in Apache HTTP Server\u0027s mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56153",
          "url": "https://www.suse.com/security/cve/CVE-2026-56153"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284048 for CVE-2026-56153",
          "url": "https://bugzilla.suse.com/1284048"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56153"
    },
    {
      "cve": "CVE-2026-56154",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56154"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use After Free vulnerability in Apache HTTP Server\u0027s mod_rewrite when using lookahead (%{LA-U:HTTP:...})\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56154",
          "url": "https://www.suse.com/security/cve/CVE-2026-56154"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284049 for CVE-2026-56154",
          "url": "https://bugzilla.suse.com/1284049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56154"
    },
    {
      "cve": "CVE-2026-63045",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63045"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63045",
          "url": "https://www.suse.com/security/cve/CVE-2026-63045"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284060 for CVE-2026-63045",
          "url": "https://bugzilla.suse.com/1284060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-63045"
    },
    {
      "cve": "CVE-2026-63292",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63292"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63292",
          "url": "https://www.suse.com/security/cve/CVE-2026-63292"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284061 for CVE-2026-63292",
          "url": "https://bugzilla.suse.com/1284061"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-63292"
    },
    {
      "cve": "CVE-2026-63686",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63686"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63686",
          "url": "https://www.suse.com/security/cve/CVE-2026-63686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284058 for CVE-2026-63686",
          "url": "https://bugzilla.suse.com/1284058"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-63686"
    },
    {
      "cve": "CVE-2026-63718",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63718"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63718",
          "url": "https://www.suse.com/security/cve/CVE-2026-63718"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284057 for CVE-2026-63718",
          "url": "https://bugzilla.suse.com/1284057"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-63718"
    },
    {
      "cve": "CVE-2026-73636",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-73636"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client\u0027s shared memory entry when AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-73636",
          "url": "https://www.suse.com/security/cve/CVE-2026-73636"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284056 for CVE-2026-73636",
          "url": "https://bugzilla.suse.com/1284056"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-73636"
    },
    {
      "cve": "CVE-2026-73637",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-73637"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-73637",
          "url": "https://www.suse.com/security/cve/CVE-2026-73637"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284055 for CVE-2026-73637",
          "url": "https://bugzilla.suse.com/1284055"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-73637"
    },
    {
      "cve": "CVE-2026-93546",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-93546"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory\u0027s property database via PROPPATCH requests declaring many XML namespaces.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
          "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
          "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-93546",
          "url": "https://www.suse.com/security/cve/CVE-2026-93546"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284053 for CVE-2026-93546",
          "url": "https://bugzilla.suse.com/1284053"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:httpd-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
            "SUSE Liberty Linux 10:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_session-0:2.4.63-13.el10_2.8.x86_64",
            "SUSE Liberty Linux 10:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-93546"
    }
  ]
}

CVE-2026-93546 (GCVE-0-2026-93546)

Vulnerability from cvelistv5 – Published: 2026-10-01 16:19 – Updated: 2026-10-01 20:09

Title

Apache HTTP Server: mod_dav_fs namespace overflow

Summary

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 19:38 UTC

CWE

CWE-190 - Integer overflow or wraparound

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1085 records in the last 180 days details

References

2 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 0 , ≤ 2.4.68 (semver)

Credits

Zhen Kong Calif.io in collaboration with Anthropic AISLE in partnership with Red Hat

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-93546",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T19:38:29.562581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T19:38:34.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-01T20:09:35.921Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/01/30"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.68",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhen Kong"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Calif.io in collaboration with Anthropic"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "AISLE in partnership with Red Hat"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory\u0027s property database via PROPPATCH requests declaring many XML namespaces."
            }
          ],
          "value": "Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory\u0027s property database via PROPPATCH requests declaring many XML namespaces."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T16:19:32.662Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-28T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-10-01T12:00:00.000Z",
          "value": "fixed in 2.4.x by r1938682"
        },
        {
          "lang": "eng",
          "time": "2026-10-01T12:00:00.000Z",
          "value": "2.4.69 released"
        }
      ],
      "title": "Apache HTTP Server: mod_dav_fs namespace overflow",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-93546",
    "datePublished": "2026-10-01T16:19:32.662Z",
    "dateReserved": "2026-09-18T09:17:50.552Z",
    "dateUpdated": "2026-10-01T20:09:35.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:89860

CVE-2026-93546 (GCVE-0-2026-93546)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour