Skip to content

CVE

CVE-2026-24072

8.8
CVSS 3.1
1
story
Severity
8.8 High · vendor score
Published
May 4, 2026
Weakness
CWE-269

What it is

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

From the National Vulnerability Database

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesSerious Apache Web Server Bug PatchedThe vulnerability (CVE-2026-23918) only affects version 2.4.66 and the Apache Software Foundation has released a fix for the bug in version 2.4.67.DENNIS FISHER · 1 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE record

Advisories, fixes & analysis

Vendor advisoryhttpd.apache.org/security/vulnerabilities_24.htmlAnalysisopenwall.com/lists/oss-security/2026/05/04/18