CVE-2026-42356CWE-430

CVE-2026-42356

Low · published October 1, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.

This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-430 · Deployment of Wrong Handler
Published
2026-10-01T20:17Z
Affected products (1)
ProductVersionsFixed in
apache/http_server≥ 2.4.0, < 2.4.692.4.69
References (2)
https://httpd.apache.org/security/vulnerabilities_24.html · [email protected]http://www.openwall.com/lists/oss-security/2026/10/01/11 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 01 OCT 15:54Z
    Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
    cvelistv5