Detections
Analytics

Ubuntu 14.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache HTTP Server vulnerabilities (USN-9016-1)

high Nessus Plugin ID 380032

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 14.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-9016-1 advisory.

 Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka, Keita Sode and Hyojae Lee discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
 (CVE-2026-46729)

 It was discovered that Apache HTTP Server did not correctly handle certain session cookies. A remote attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-47360)

 Zhen Kong discovered that Apache HTTP Server did not correctly handle certain forms of authentication. An unauthenticated remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-48005)

 Bartlomiej Dmitruk and Masumi Tanaka discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-56153)

 Lucian Nitescu discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10.
 (CVE-2026-56449)

 It was discovered that Apache HTTP Servers mod_rewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-56154)

 Lucian Nitescu, Simon Kappel, and Gianluca Danesin discovered that Apache HTTP Servers mod_http2 module incorrectly handled memory when processing certain HTTP/2 connections. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-57941)

 Juthawong Naisanguansee, Charles Vosburgh, Mike Read, and Ryoma Nishioka discovered that Apache HTTP Servers mod_ssl module incorrectly handled certain expressions. An attacker could possibly use this issue to bypass intended access restrictions. This issue only affected Ubuntu 26.10. (CVE-2026-59797)

discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-58415)

 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. This issue only affected Ubuntu 26.10. (CVE-2026-63045)

 Hyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-63292)

 Lucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not properly handle certain responses from backend servers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-63686)

 Qing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP responses from backend servers. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks. This issue only affected Ubuntu 26.10. (CVE-2026-63718)

 Hyojae Lee discovered that Apache HTTP Server did not properly validate Digest authentication requests. A machine-in-the-middle attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 26.10. (CVE-2026-73636)

 Zhen Kong and Darren Carreras discovered that Apache HTTP Server did not properly manage authentication requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-73637)

 Vlatko Kosturjak discovered that Apache HTTP Server did not properly enforce access restrictions for user directories. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-79768)

 Zhen Kong discovered that Apache HTTP Server did not properly handle certain WebDAV requests. An authenticated user could possibly use this issue to cause a denial of service or corrupt WebDAV property data. This issue only affected Ubuntu 26.10. (CVE-2026-93546)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-9016-1

Plugin Details

Severity: High

ID: 380032

File Name: ubuntu_USN-9016-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/13/2026

Updated: 11/13/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-56449

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:14.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, cpe:/o:canonical:ubuntu_linux:26.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:apache2-bin, p-cpe:/a:canonical:ubuntu_linux:apache2-data, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-event, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-itk, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-prefork, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-worker, p-cpe:/a:canonical:ubuntu_linux:apache2-suexec-custom, p-cpe:/a:canonical:ubuntu_linux:apache2-suexec-pristine, p-cpe:/a:canonical:ubuntu_linux:apache2-suexec, p-cpe:/a:canonical:ubuntu_linux:apache2-utils, p-cpe:/a:canonical:ubuntu_linux:apache2.2-bin, p-cpe:/a:canonical:ubuntu_linux:apache2, p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-macro, p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-md, p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-proxy-html, p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-proxy-uwsgi

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Ease: No known exploits are available

Patch Publication Date: 11/10/2026

Vulnerability Publication Date: 10/1/2026

Reference Information

CVE: CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56449

IAVA: 2026-A-1087-S

USN: 9016-1