Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.
This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Oct 5, 2026 | Oct 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade httpd-toolsUpgrade mod_ldapUpgrade mod_sessionUpgrade mod_proxy_htmlUpgrade httpd-filesystemUpgrade httpd-manualUpgrade httpdUpgrade httpd-develUpgrade mod_sslUpgrade httpd-debuginfoUpgrade mod_md | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade mod_sessionUpgrade httpd-core-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_ldapUpgrade httpd-filesystemUpgrade mod_proxy_html-debuginfoUpgrade mod_http2Upgrade mod_session-debuginfoUpgrade mod_proxy_htmlUpgrade httpd-manualUpgrade mod_ssl-debuginfoUpgrade mod_http2-debuginfoUpgrade mod_luaUpgrade httpd-debuginfoUpgrade mod_lua-debuginfoUpgrade httpd-tools-debuginfoUpgrade httpd-develUpgrade httpd-coreUpgrade httpd-debugsourceUpgrade httpd-toolsUpgrade mod_sslUpgrade httpd | Oct 13, 2026 | Oct 1, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 2, 2026 | Oct 1, 2026 |
| Debian | — | Upgrade apache2 | Oct 20, 2026 | Oct 1, 2026 |
| Freebsd | — | Upgrade apache24 | Oct 5, 2026 | Oct 1, 2026 |
| Redhat_linux | — | No solution exists | Oct 5, 2026 | Oct 1, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Oct 1, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub