Detections
Analytics
Debian dsa-6248 : apache2 - security update
critical Nessus Plugin ID 312666
Synopsis
The remote Debian host is missing one or more security-related updates.Description
The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6248 advisory.- ------------------------------------------------------------------------- Debian Security Advisory DSA-6248-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 06, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : apache2 CVE ID : CVE-2026-23918 CVE-2026-24072 CVE-2026-28780 CVE-2026-29168 CVE-2026-29169 CVE-2026-33006 CVE-2026-33007 CVE-2026-33523 CVE-2026-33857 CVE-2026-34032 CVE-2026-34059 Debian Bug : 1135737
Multiple vulnerabilities have been discovered in the Apache HTTP server, which may result in remote code execution, privilege escalation, denial of service or information disclosure.
For the oldstable distribution (bookworm), these problems have been fixed in version 2.4.67-1~deb12u2.
For the stable distribution (trixie), these problems have been fixed in version 2.4.67-1~deb13u2. The fix for CVE-2026-23918 was already included in the Debian 13.4 point release update versioned 2.4.66-1~deb13u2 to address reported HTTP/2 regressions.
We recommend that you upgrade your apache2 packages.
For the detailed security status of apache2 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/apache2
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: [email protected]
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the apache2 packages.See Also
https://security-tracker.debian.org/tracker/source-package/apache2
https://security-tracker.debian.org/tracker/CVE-2026-23918
https://security-tracker.debian.org/tracker/CVE-2026-24072
https://security-tracker.debian.org/tracker/CVE-2026-28780
https://security-tracker.debian.org/tracker/CVE-2026-29168
https://security-tracker.debian.org/tracker/CVE-2026-29169
https://security-tracker.debian.org/tracker/CVE-2026-33006
https://security-tracker.debian.org/tracker/CVE-2026-33007
https://security-tracker.debian.org/tracker/CVE-2026-33523
https://security-tracker.debian.org/tracker/CVE-2026-33857
https://security-tracker.debian.org/tracker/CVE-2026-34032
https://security-tracker.debian.org/tracker/CVE-2026-34059
Plugin Details
Severity: Critical
ID: 312666
File Name: debian_DSA-6248.nasl
Version: 1.1
Type: Local
Agent: unix
Family: Debian Local Security Checks
Published: 5/6/2026
Updated: 5/6/2026
Supported Sensors: Continuous Assessment, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.0
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-28780
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:apache2-bin, p-cpe:/a:debian:debian_linux:libapache2-mod-md, p-cpe:/a:debian:debian_linux:libapache2-mod-proxy-uwsgi, p-cpe:/a:debian:debian_linux:apache2-doc, p-cpe:/a:debian:debian_linux:apache2-suexec-custom, cpe:/o:debian:debian_linux:13.0, p-cpe:/a:debian:debian_linux:apache2, p-cpe:/a:debian:debian_linux:apache2-suexec-pristine, p-cpe:/a:debian:debian_linux:apache2-dev, p-cpe:/a:debian:debian_linux:apache2-data, p-cpe:/a:debian:debian_linux:apache2-utils, p-cpe:/a:debian:debian_linux:apache2-ssl-dev, cpe:/o:debian:debian_linux:12.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/6/2026
Vulnerability Publication Date: 5/4/2026
Reference Information
CVE: CVE-2026-23918, CVE-2026-24072, CVE-2026-28780, CVE-2026-29168, CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523, CVE-2026-33857, CVE-2026-34032, CVE-2026-34059