VulnSocial

CVE-2026-44631Patch(apache / http_server)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (4 latest mentions)

Immediate actions

  • Patch apache http_server systems immediately
  • Hunt for exploitation attempts and persistence artifacts

Recommended action window: High priority (within 72h)

NVD description

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

apache CVEsBack to dashboard
2.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-124

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • http_server

Threat summary

  • Exploit tooling references are present in monitored signal
  • Patch or workaround signal is available
  • 7 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • Patch or workaround mentioned in 5 signals
  • Technical details provided in 7 signals
  • Disclosure: 2 classified signals
  • Peaked at 4 mentions on most recent observed day (2026-07-14)
  • 7 total mentions across 4 days

Affected systems

Vendors
apache
Products
http_server

Deep dive

Activity timeline7 mentions / 4d
01234Mentions · 2026-06-08: 1Mentions · 2026-06-23: 1Mentions · 2026-07-02: 1Mentions · 2026-07-14: 4Exploit Tool / Code · 2026-07-02: 1Patch / Workaround · 2026-06-08: 1Patch / Workaround · 2026-06-23: 1Patch / Workaround · 2026-07-02: 1Patch / Workaround · 2026-07-14: 2Technical Details · 2026-06-08: 1Technical Details · 2026-06-23: 1Technical Details · 2026-07-02: 1Technical Details · 2026-07-14: 406-0806-2307-0207-14
Signal classification2 categories
Patch
571.4%
Disclosure
228.6%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-06-081
Patch1
2026-06-231
Patch1
2026-07-021
Patch1
2026-07-144
Disclosure2Patch2
Full discourse7 posts
  • Wazuh@wazuh
    Patch

    Apache HTTP Server is affected by CVE-2026-44631 (CVSS 9.8 - Critical), a buffer underwrite flaw that may lead to memory corruption and code execution. This issue is fixed in version 2.4.68. Update immediately. Read on: https://ow.ly/cuQG50ZfRZF #Vulnerability #Cybersecurity https://t.co/lknzy6YLZf

    Post summary

    Apache HTTP Server CVE‑2026‑44631 is a critical buffer underwrite flaw fixed in version 2.4.68; users are urged to upgrade immediately.

    0100162882
    8.1K followersView on X
  • Lyrie.ai@lyrie_ai
    Patch

    Full Tweet Apache HTTP Server is affected by CVE-2026-44631 (CVSS 9.8 - Critical), a buffer underwrite flaw that may lead to memory corruption and code execution. This issue is fixed in version 2.4.68. Update immediately.

    Post summary

    The tweet alerts that CVE‑2026‑44631 is a critical buffer underwrite flaw in Apache HTTP Server, fixed in 2.4.68, and advises immediate update.

    1000032
    318 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    0day Intel: Apache HTTP Server is affected by CVE-2026-44631 (CVSS 9.8 - Critical), a buffer

    Post summary

    This 0day alert announces that Apache HTTP Server is affected by CVE-2026-44631, a critical buffer-related vulnerability with a CVSS score of 9.8.

    1000036
    318 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    Source: X search for CVE-2026 critical Posted: 2026-06-23T15:00:19.000Z Likes: 12 0day Intel: Apache HTTP Server is affected by CVE-2026-44631 (CVSS 9.8 - Critical), a buffer

    Post summary

    A short alert announcing that Apache HTTP Server is affected by the critical CVE-2026-44631 (CVSS 9.8), but no PoC, exploit code, or patch information is disclosed.

    1000040
    318 followersView on X
  • Lyrie.ai@lyrie_ai
    Patch

    CVE-2026-44631: Apache HTTP Server is affected by CVE-2026-44631 (CVSS 9.8 - Critical), a buffer underwrite flaw that may lead to memory corruption and code execution. This issue is fixed in version 2.4.68. Update immediately. Read on:

    Post summary

    The advisory reveals a critical buffer‑underwrite vulnerability (CVE‑2026‑44631) in Apache HTTP Server that could enable memory corruption and code execution. It recommends upgrading to version 2.4.68 immediately to address the issue.

    1000046
    318 followersView on X
  • Stanislav Klevtsov@stansecure
    Patch

    Top #CVE to #patch this week 👀 - @Ubiquiti UniFi OS (CVE-2026-34908, 34909, 34910) critical flaws - @Cisco UCM (CVE-2026-20230) SSRF to root - Another two @Linux Privesc pedit COW(CVE-2026-46331), DirtyClone - @Linux kernel — new DirtyFrag family privesc, JFrog published exploit - @apache_httpd Server (CVE-2026-44631, CVE-2026-29167) - @splunk Enterprise (CVE-2026-20253) missing auth - @nginx Plus (CVE-2026-42055) - @squidproxy (CVE-2026-47729) Squidbleed, a 29-year-old memory leak found by Mythos. Update to v7.6

    Post summary

    The post catalogs several critical CVEs, notes available exploit for the Linux DirtyFrag family, and stresses the need to apply patches, specifically updating squidproxy to v7.6.

    10000187
    43 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    Apache HTTP Server 2.4.0-2.4.67: critical heap underflow via crafted regex in config (CVE-2026-44631, CVSS 9.8). No auth needed, full CIA impact. Upgrade past 2.4.67 now. #Apache #infosec https://secalerts.co/vulnerability/CVE-2026-44631

    Post summary

    A warning about CVE-2026-44631, a critical heap underflow in Apache HTTP Server, recommending an immediate upgrade beyond version 2.4.67 to mitigate the vulnerability.

    00000108
    832 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachehttp_server---

Explore more

Back to dashboardapache CVEshttp_server vulnerabilities