Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

freebsd 1ccc383b-486a-11f1-8b62-8447094a420f: www/apache24 -- Multiple vulnerabilities

[Web App Scanning] Apache 2.4.x < 2.4.67 Multiple Vulnerabilities

The version of httpd installed on the remote host is prior to 2.4.67. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-124-01 advisory.

    New httpd packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache httpd installed on the remote host is prior to 2.4.67. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.67 advisory.

  - Apache HTTP Server: mod_authn_socache crash: A NULL pointer dereference in the mod_authn_socache in Apache     HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching     forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
    Acknowledgements: finder: Pavel Kohout, Aisle Research, Aisle.com (CVE-2026-33007)

  - Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects     Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the     issue. (CVE-2026-34032)

  - An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess     authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version     2.4.67, which fixes this issue. (CVE-2026-24072)

  - Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP     Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
    (CVE-2026-33857)

  - Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through     2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue. (CVE-2026-34059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
312108	Slackware Linux 15.0 / current httpd Multiple Vulnerabilities (SSA:2026-124-01)	Nessus	Slackware Local Security Checks	high
311940	Apache 2.4.x < 2.4.67 Multiple Vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2026-33857

medium

Tenable Plugins

Coming Soon

high

high