The version of Apache httpd installed on the remote host is prior to 2.4.68. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.68 advisory.

  - CVE-2026-49975, also known as HTTP/2 Bomb, is a remote denial-of-service exploit against most major web     servers, including: nginx, Apache httpd, Microsoft IIS, Envoy, Cloudflare Pingor. The vulnerable behavior     exists in each server's default HTTP/2 configuration (CVE-2026-49975)

  - mod_xml2enc heap overflow: Heap-based Buffer Overflow vulnerability in Apache HTTP Server with     mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0     through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
    Acknowledgements: finder: Zhenpeng (Leo) Lin at depthfirst (CVE-2026-42536)

  - OOB Read in `merge_response_headers` can cause crash: Out-of-bounds Read vulnerability in Apache HTTP     Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP     Server: from 2.4.0 through 2.4.67. Acknowledgements: finder: Zhenpeng (Leo) Lin at depthfirst     (CVE-2026-43951)

  - escalation of privilege through expressions in .htaccess in multiple modules: Improper Privilege     Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read     files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67.
    Users are recommended to upgrade to version 2.4.68, which fixes the issue. Acknowledgements:
    (CVE-2026-44119)

  - Stack Buffer Over-Read in mod_ssl OCSP `send_request`: Buffer Over-read vulnerability in Apache HTTP     Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP     Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the     issue. Acknowledgements: finder: Zhenpeng (Leo) Lin at depthfirst (CVE-2026-44185)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Apache 2.4.x < 2.4.68 Multiple Vulnerabilities

high Nessus Plugin ID 319665

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jun 12, 2026, 7:53 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202606121953
Version 1.2 Jun 9, 2026, 11:10 AM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSS metrics ("CVSSv3 score" set to 9.8) CVSSv3 score source (set to "CVE-2026-44631") Plugin Feed: 202606091110
Version 1.1 Jun 9, 2026, 4:51 AM New Plugin Feed: 202606090451