Apache has released security updates for Apache HTTP Server and Apache MINA that address multiple vulnerabilities, including flaws tied to possible remote code execution, denial of service, information disclosure, response manipulation, and authentication bypass risks.
The HTTP Server update arrives as version 2.4.67 and fixes 11 tracked vulnerabilities. Separately, Apache MINA 2.2.7 and 2.1.12 correct two critical security issues in the MINA line that were expected to have been resolved in earlier releases.
For administrators, the main takeaway is direct: review exposed Apache HTTP Server deployments, confirm whether HTTP/2 or AJP proxying is in use, and move affected systems to fixed versions as soon as operational testing allows. MINA users should also upgrade and review serialization allowlist settings, because the fix still requires secure configuration in applications that use object serialization.
What Apache Fixed in HTTP Server 2.4.67
Apache HTTP Server 2.4.67 includes fixes for 11 vulnerabilities. The most serious issues include a double-free flaw in HTTP/2 handling and a heap-based buffer overflow in the AJP proxy module.
CVE-2026-23918 is described as a double-free issue in Apache HTTP Server’s HTTP/2 protocol handling. The issue affects Apache HTTP Server 2.4.66 and has been associated with denial-of-service impact and possible remote code execution under certain conditions. Systems running Apache HTTP Server 2.4.66 with HTTP/2 enabled should be treated as a priority for review and upgrade.
CVE-2026-28780 affects mod_proxy_ajp. The vulnerability involves a heap-based buffer overflow that can occur when mod_proxy_ajp connects to a malicious AJP server. In that scenario, the malicious backend can send a crafted AJP message back to the proxy module and cause memory corruption. The issue affects Apache HTTP Server versions through 2.4.66, and the recommended fix is to upgrade to 2.4.67.
Those details matter because the practical exposure is different for the two flaws. The HTTP/2 issue is relevant to deployments using the affected HTTP/2 handling path in version 2.4.66. The AJP issue is especially relevant where Apache is configured to proxy traffic to AJP backends, particularly if the backend trust boundary is weak or misconfigured.
Denial-of-Service, Disclosure, and Bypass Issues
The HTTP Server release also addresses several additional vulnerabilities with lower but still meaningful operational impact. Some could allow denial-of-service conditions, while others could expose information or interfere with HTTP response handling.
The vulnerabilities disclosed with the 2.4.67 release include:
- CVE-2026-23918, an HTTP/2 double-free issue affecting Apache HTTP Server 2.4.66.
- CVE-2026-28780, a heap-based buffer overflow in mod_proxy_ajp affecting versions through 2.4.66.
- CVE-2026-29168, CVE-2026-29169, and CVE-2026-33007, which are associated with denial-of-service risks.
- CVE-2026-24072, CVE-2026-33857, CVE-2026-34032, and CVE-2026-34059, which are associated with information disclosure risks.
- CVE-2026-33523, an issue involving improper neutralization of CRLF sequences that could affect HTTP responses.
- CVE-2026-33006, a timing side-channel weakness tied to Digest authentication bypass risk.
Organizations should avoid treating the update as only an RCE patch. Denial-of-service and information disclosure bugs can still create real exposure, especially on internet-facing services, shared hosting infrastructure, reverse proxies, and systems that sit in front of sensitive applications.
The Digest authentication timing issue also deserves attention in environments that still rely on Digest authentication for access control. Even when an authentication mechanism is not the primary identity layer, bypass weaknesses can undermine assumptions made by downstream applications, monitoring tools, or protected administrative paths.
Apache MINA Updates Correct Critical Serialization Fixes
Apache also released MINA 2.2.7 and 2.1.12 to fix two critical vulnerabilities. The project stated that the relevant security corrections were expected to have been included in earlier MINA releases, but the required code changes were not applied to the affected 2.1.x and 2.2.x branches.
CVE-2026-42778 is tied to unbounded deserialization in Apache MINA applications. It is related to earlier work on CVE-2026-41409 and CVE-2024-52046. The underlying concern is that Java native deserialization can be dangerous when untrusted serialized data is accepted without adequate restrictions. In affected MINA use cases, specially crafted serialized data could potentially lead to remote code execution.
CVE-2026-42779 is related to an incomplete fix for CVE-2026-41635. The issue involves improper checking that could allow an allowlist bypass and code execution in affected configurations.
The affected MINA branches include Apache MINA 2.1 through 2.1.11 and Apache MINA 2.2 through 2.2.6. The fixed releases are Apache MINA 2.1.12 and 2.2.7.
Why Configuration Still Matters After the MINA Upgrade
The MINA update is not just a version bump. Apache’s guidance for applications using ObjectSerializationDecoder is that organizations should explicitly define which classes the decoder is allowed to accept.
That requirement is important because deserialization vulnerabilities are often not solved by patching alone if an application continues to accept broad or untrusted object types. A safer deployment should use a narrow allowlist that reflects the application’s actual protocol needs, rather than allowing arbitrary classes to be deserialized.
In practical terms, teams using MINA should review where ObjectSerializationDecoder is instantiated, identify whether serialized input can come from untrusted clients or remote systems, and confirm that only expected classes are permitted.
What Administrators Should Do Now
Administrators should begin with asset identification. Apache HTTP Server is widely deployed directly, through hosting control panels, inside appliances, and as part of packaged application stacks. Version checks should include vendor-managed builds, container images, base operating system packages, and embedded distributions.
A practical response plan should include the following steps:
- Identify Apache HTTP Server deployments and confirm the exact running version.
- Prioritize systems running Apache HTTP Server 2.4.66, especially if HTTP/2 is enabled.
- Check whether mod_proxy_ajp is enabled and whether Apache connects to AJP backends.
- Upgrade affected Apache HTTP Server deployments to version 2.4.67 or a vendor-supplied fixed package.
- Inventory applications using Apache MINA 2.1.x or 2.2.x.
- Upgrade MINA 2.1 deployments to 2.1.12 and MINA 2.2 deployments to 2.2.7.
- Review ObjectSerializationDecoder usage and configure explicit class allowlists where serialization is used.
- Monitor logs for crashes, unusual HTTP/2 behavior, unexpected AJP backend interactions, and authentication anomalies.
For many organizations, the biggest delay will not be the Apache update itself but finding every place where the affected components are present. Apache HTTP Server may be installed through an operating system repository, bundled with a control panel, included in a container image, or managed by a third-party platform. MINA may be present as an application dependency rather than a directly installed service.
Risk Depends on Configuration, but Patching Should Not Wait
The highest-risk scenarios are likely to involve internet-facing Apache HTTP Server deployments, systems running 2.4.66 with HTTP/2 enabled, and environments where AJP proxying crosses a weak trust boundary. MINA exposure depends heavily on whether affected applications use object serialization and whether untrusted data can reach the decoder.
That said, the presence of possible RCE language in the HTTP/2 issue and critical severity in the MINA advisories should push these updates toward the front of the patch queue. Even when exploitation conditions are specific, widely deployed infrastructure software tends to attract quick analysis from attackers after public disclosure.
Security teams should also be careful with vendor package timing. Some environments may not receive the upstream version number immediately, even after a downstream vendor ships a backported fix. The operational question is not only whether the version string says 2.4.67, but whether the package maintainer has included the relevant fixes.
For Apache HTTP Server, organizations should verify remediation through trusted package advisories, changelogs, or vulnerability scanners that understand vendor backports. For MINA, dependency management tools should be used to find vulnerable library versions in application builds, including transitive dependencies.
Bottom Line
Apache HTTP Server 2.4.67 closes a set of vulnerabilities that include possible remote code execution, denial-of-service, information disclosure, response handling, and authentication-related risks. Apache MINA 2.2.7 and 2.1.12 address critical issues tied to incomplete earlier fixes, including deserialization and allowlist bypass concerns.
The safest path is to patch quickly, verify that the fixed packages are actually in place, and review configuration details that affect exposure. For MINA users, that includes tightening ObjectSerializationDecoder class allowlists rather than assuming the version update alone covers every risky use case.