Ubuntu 26.04 Apache2 Important Memory Crash Threat USN-8239-1

ubuntu

May 6, 2026

Several security issues were fixed in Apache HTTP Server.

Summary

Several security issues were fixed in Apache HTTP Server.

Software Description:

- apache2: Apache HTTP server

Details:

Bartlomiej Dmitruk and Stanislaw Strzalkowski discovered that Apache

HTTP Server incorrectly handled certain memory operations when using the

HTTP/2 protocol. A remote attacker could use this issue to cause Apache

HTTP Server to crash, resulting in a denial of service, or possibly execute

arbitrary code. This issue only affected Ubuntu 26.04 LTS.

(CVE-2026-23918)

It was discovered that the Apache HTTP Server mod_rewrite module

incorrectly handled certain privileges. A local attacker could possibly use

this issue to obtain sensitive information. (CVE-2026-24072)

Andrew Lacambra, Elhanan Haenel, Tianshuo Han, and Tristan Madani

discovered that the Apache HTTP Server mod_proxy_ajp module incorrectly

handled certain AJP server messages. An attacker in control of a backend

AJP server could use this issue to cause Apache HTTP Server to crash,

resulting in a denial o...

Read the Full Advisory

Topics Covered

security advisory denial of service Ubuntu important memory issue apache2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  apache2                         2.4.66-2ubuntu2.1

Ubuntu 25.10
  apache2                         2.4.64-1ubuntu3.4

Ubuntu 24.04 LTS
  apache2                         2.4.58-1ubuntu8.12

Ubuntu 22.04 LTS
  apache2                         2.4.52-1ubuntu4.20

In general, a standard system update will make all the necessary changes.