Detections
Analytics
Alpine: multiple apache2 packages: security update to 2.4.68-r0
high Tenable Self-Hosted Container Security Plugin ID 478589
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial
of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
(CVE-2026-49975)
- Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue
affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68,
which fixes the issue. (CVE-2026-29167)
- A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache
HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy
configuration. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
(CVE-2026-29170)
- A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an
untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
(CVE-2026-34355)
- Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and
ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are
recommended to upgrade to version 2.4.68, which fixes the issue. (CVE-2026-34356)
Solution
Update the apache2 library and its related packages to version 2.4.68-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-29167
https://security.alpinelinux.org/vuln/CVE-2026-29170
https://security.alpinelinux.org/vuln/CVE-2026-34355
https://security.alpinelinux.org/vuln/CVE-2026-34356
https://security.alpinelinux.org/vuln/CVE-2026-42535
https://security.alpinelinux.org/vuln/CVE-2026-42536
https://security.alpinelinux.org/vuln/CVE-2026-43951
https://security.alpinelinux.org/vuln/CVE-2026-44119
https://security.alpinelinux.org/vuln/CVE-2026-44185
https://security.alpinelinux.org/vuln/CVE-2026-44186
https://security.alpinelinux.org/vuln/CVE-2026-44631
Plugin Details
Severity: High
ID: 478589
Version: Revision 1.1
Type: Local
Published: 11/6/2026
Updated: 11/6/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.28
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-49975
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2026-44631
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 7.7
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/3/2026
Reference Information
CVE: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356, CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119, CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913, CVE-2026-49975
IAVA: 2026-A-0558-S