A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of se

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• Debian:12 apache22.4.57-2, 2.4.57-3, 2.4.58-1
• Debian:13 apache20 → 2.4.69-1~deb13u1
• Debian:14 apache20 → 2.4.69-1

How to fix CVE-2026-63686

• Recommended remediation

  A patch or advisory reference is linked. Open the original publisher for availability by product version.

• Official advisories

  • Apache Software Foundation · httpd.apache.org
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • Trivy Vulnerability DB · osv.dev
  • Ubuntu Security Notices · ubuntu.com

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · Ubuntu Security Notices

   Detected

   이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. (CVE-2026-

2. Oct 16, 2026 · Trivy Vulnerability DB

   Fix available

   apache2 fixed in 2.4.69-1~deb13u1; apache2 fixed in 2.4.69-1

3. Oct 16, 2026 · Trivy Vulnerability DB

   Fix available

   apache2 fixed in 2.4.69-1~deb13u1

4. Oct 16, 2026 · Trivy Vulnerability DB

   Fix available

   apache2 fixed in 2.4.69-1

5. Oct 16, 2026 · Trivy Vulnerability DB

   Updated

   A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Sources

• Apache Software FoundationVendor advisoryCVE-2026-63686

  CVE-2026-63686 is named on the public Apache Software Foundation page.

  httpd.apache.org
• CVE.orgVulnerability recordCVE-2026-63686

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-63686

  30-day exploitation probability 0.5%

  first.org
• Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-63686

  A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users ar

  osv.dev
• Ubuntu Security NoticesVendor advisoryCVE-2026-63686

  이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server res

  ubuntu.com

References

• ADVISORY · security-tracker.debian.org

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.