CVE-2026-63686
Public on 2026-10-01
Modified on 2026-10-03
Description
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | httpd | 2026-10-12 | ALAS2-2026-3990 | Fixed |
| Amazon Linux 2023 | httpd | 2026-10-12 | ALAS2023-2026-3202 | Fixed |
| Amazon Linux 2027 Preview | httpd | 2026-10-12 | ALAS2027-2026-207 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |