Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.
This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
Users are recommended to upgrade to version 2.4.66 which fixes the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade httpd-develUpgrade mod_luaUpgrade httpdUpgrade mod_proxy_htmlUpgrade httpd-toolsUpgrade httpd-manualUpgrade mod_sslUpgrade httpd-filesystemUpgrade mod_ldapUpgrade mod_sessionUpgrade mod_mdUpgrade mod_http2Upgrade httpd-core | Dec 23, 2025 | Dec 22, 2025 |
| Alpine Linux | — | Upgrade apache2 | Dec 8, 2025 | Dec 5, 2025 |
| Amazon Linux Ami 2 | — | Upgrade httpdUpgrade mod_sslUpgrade mod_sessionUpgrade httpd-debuginfoUpgrade httpd-filesystemUpgrade httpd-develUpgrade mod_mdUpgrade mod_ldapUpgrade mod_proxy_htmlUpgrade httpd-toolsUpgrade httpd-manual | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade httpd-filesystemUpgrade mod_luaUpgrade mod_proxy_htmlUpgrade mod_ssl-debuginfoUpgrade httpd-debuginfoUpgrade mod_sessionUpgrade mod_session-debuginfoUpgrade mod_ldapUpgrade mod_proxy_html-debuginfoUpgrade httpd-tools-debuginfoUpgrade httpd-toolsUpgrade httpdUpgrade httpd-coreUpgrade mod_sslUpgrade httpd-develUpgrade mod_ldap-debuginfoUpgrade httpd-manualUpgrade httpd-core-debuginfoUpgrade httpd-debugsourceUpgrade mod_lua-debuginfo | Jan 12, 2026 | Dec 5, 2025 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Dec 8, 2025 | Dec 5, 2025 |
| Apple Osx Apache | — | Upgrade macOS to the latest version | Mar 27, 2026 | Mar 24, 2026 |
| Debian | — | Upgrade apache2 | Jan 12, 2026 | Jan 12, 2026 |
| Freebsd | — | Upgrade apache24 | Dec 10, 2025 | Dec 4, 2025 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Aug 16, 2026 | Aug 13, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade mod_sslUpgrade httpd-toolsUpgrade httpdUpgrade httpd-filesystem | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade httpd-toolsUpgrade httpd-filesystemUpgrade mod_sslUpgrade httpd | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade httpd-filesystemUpgrade httpd-toolsUpgrade mod_sslUpgrade httpd | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade httpd-filesystemUpgrade mod_sslUpgrade httpdUpgrade httpd-tools | Mar 10, 2026 | Mar 10, 2026 |
| Ibm Http_server | — | Apply IBM HTTP Server version 8.5.5.29 or laterApply IBM HTTP Server version 9.0.5.27 or laterApply IBM HTTP Server Interim Fix PH68462 | Mar 25, 2026 | Dec 15, 2025 |
| Oracle Httpserver | — | Apply patch 39073998 to Oracle HTTP Server 12.2.1.4.0.Apply patch 39086822 to Oracle HTTP Server 14.1.2.0.0. | Sep 30, 2026 | Dec 5, 2025 |
| Oracle_linux | — | Upgrade httpd-manualUpgrade mod_mdUpgrade mod_sslUpgrade mod_ldapUpgrade mod_sessionUpgrade mod_http2Upgrade httpd-coreUpgrade httpd-filesystemUpgrade httpdUpgrade httpd-develUpgrade mod_luaUpgrade mod_proxy_htmlUpgrade httpd-tools | Dec 24, 2025 | Dec 5, 2025 |
| Redhat_linux | — | Upgrade httpd-coreUpgrade mod_lua-debuginfoUpgrade httpd-manualUpgrade mod_http2-debugsourceUpgrade mod_sessionUpgrade mod_sslUpgrade httpd-core-debuginfoUpgrade httpd-debugsourceUpgrade httpd-debuginfoUpgrade mod_mdUpgrade mod_proxy_html-debuginfoUpgrade httpdUpgrade mod_http2-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_md-debuginfoUpgrade mod_ldapUpgrade mod_luaUpgrade mod_ssl-debuginfoUpgrade mod_proxy_htmlUpgrade mod_http2Upgrade httpd-tools-debuginfoUpgrade mod_md-debugsourceUpgrade httpd-toolsNo solution existsUpgrade mod_session-debuginfoUpgrade httpd-filesystemUpgrade httpd-devel | Dec 23, 2025 | Dec 5, 2025 |
| Rocky_linux | — | Upgrade mod_session-debuginfoUpgrade mod_luaUpgrade mod_ssl-debuginfoUpgrade mod_lua-debuginfoUpgrade httpd-core-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade httpd-tools-debuginfoUpgrade mod_http2Upgrade httpd-toolsUpgrade mod_ldapUpgrade httpd-debugsourceUpgrade mod_sessionUpgrade httpd-coreUpgrade mod_proxy_htmlUpgrade mod_http2-debugsourceUpgrade mod_http2-debuginfoUpgrade httpd-develUpgrade httpd-debuginfoUpgrade httpdUpgrade mod_md-debuginfoUpgrade mod_mdUpgrade mod_ldap-debuginfoUpgrade mod_sslUpgrade mod_md-debugsource | Feb 5, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade apache2 (Ubuntu Pro)Upgrade apache2 | Jan 20, 2026 | Dec 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub