Apache has released security updates for HTTP Server and MINA addressing vulnerabilities that the projects say could allow remote code execution in affected configurations, alongside denial-of-service, information-disclosure and authentication-bypass risks.
HTTP Server 2.4.67, released on May 4, 2026, fixes 11 tracked vulnerabilities. MINA 2.2.7 and 2.1.12, announced on April 30, correct two issues the MINA project describes as critical after intended security changes were omitted from two release branches.
HTTP/2 flaw affects upstream version 2.4.66
CVE-2026-23918 is a double-free vulnerability in HTTP Server’s HTTP/2 protocol handling. Apache identifies upstream version 2.4.66 as affected and version 2.4.67 as the fixed release. The exposure involves HTTP/2 handling; Canonical says a remote attacker could cause a server crash or possibly execute arbitrary code.
CVE-2026-28780 is a heap-based buffer overflow in mod_proxy_ajp affecting upstream HTTP Server releases through 2.4.66. Apache says exploitation requires the proxy module to connect to a malicious AJP backend, which can return a crafted message that writes beyond a heap buffer. Canonical says an attacker controlling that backend could cause a crash or possibly execute arbitrary code.
The two vulnerabilities therefore involve different exposure conditions: HTTP/2 processing in version 2.4.66 for the first, and communication with a malicious AJP backend for the second.
Other fixes address disclosure, crashes and response handling
CVE-2026-24072 concerns privilege handling associated with mod_rewrite and other modules in HTTP Server 2.4.66 and earlier. Apache says local users able to author .htaccess files could read files with the privileges of the HTTP Server process. Canonical likewise describes a local-attacker scenario.
Denial-of-service fixes include CVE-2026-29168, involving unrestricted resource allocation while mod_md processes OCSP response data, and CVE-2026-29169, involving a crash in mod_dav_lock. CVE-2026-33007 affects mod_authn_socache; Apache describes a child-process crash that an unauthenticated remote user could trigger in a caching forward proxy configuration.
Canonical identifies CVE-2026-33857, an out-of-bounds read in mod_proxy_ajp, as a potential server-crash issue. It also describes possible information disclosure from CVE-2026-34032 in that module, while CVE-2026-34059 could cause a crash or potentially expose sensitive information.
CVE-2026-33523 concerns HTTP response splitting in multiple modules when they communicate with untrusted or compromised backend servers. Canonical says an attacker could potentially inject arbitrary HTTP headers. The release also fixes CVE-2026-33006, a timing weakness in mod_auth_digest that could allow a remote attacker to bypass Digest authentication.
MINA updates repair omitted serialization fixes
The MINA project said security changes intended for its previous releases had been applied only to the 2.0.x branch, leaving versions 2.1.11 and 2.2.6 without the corrections. MINA 2.1.12 and 2.2.7 address those omissions.
The affected versions are MINA 2.1 through 2.1.11 and MINA 2.2 through 2.2.6. The project says specially crafted serialized data could potentially lead to remote code execution in applications using the affected deserialization functionality.
CVE-2026-42778 concerns the incomplete correction for CVE-2026-41409, following earlier work on CVE-2024-52046. The project says a class allowlist introduced in December 2024 checked classes too late to prevent static initializers from running for classes that were not permitted.
CVE-2026-42779 concerns the correction for CVE-2026-41635. MINA says static classes or primitive types could bypass the allowlist check.
The project says an application is affected only if it calls IoBuffer#getObject(). That method can be reached through a ProtocolCodecFilter configured with ObjectSerializationCodecFactory, so exposure depends on how the application uses the library.
MINA also says applications using ObjectSerializationDecoder must explicitly configure which classes the decoder accepts after upgrading. The updated decoder rejects classes by default, including String and byte[].
