AS-2026-013: Apache HTTP Server

2026-08-03

---

Statement

The Apache Software Foundation announced multiple vulnerabilities that have been fixed in the latest release of Apache HTTP Server 2.4.68.

CVE-2026-43951 and CVE-2026-44119 will affect ASUSTOR products with Apache HTTP Server 2.4.62 installed.

• Apache HTTP Server 2.4.68.r173 has been released on App Central to resolve the issues on ADM 5.0 and above.

Affected Products

Product	Severity	Fixed Release Availability
ADM 5.0 and 5.1	Moderate	Upgrade Apache HTTP Server to 2.4.68.r173 on ADM 5.1.4.RJV2 or above.
ADM 4.3, 4.2 and 4.1	Moderate	Ongoing.

Detail

• CVE-2026-43951
  • Severity: Medium
  • CVSS3.1 Base Score: 6.5
  • CVSS3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
• CVE-2026-44119
  • Severity: Medium
  • CVSS3.1 Base Score: 5.5
  • CVSS3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Reference

• Apache HTTP Server 2.4 vulnerabilities
• CVE-2026-43951
• CVE-2026-44119

Revision

Revision	Date	Description
1	2026-07-01	Initial public release.
2	2026-08-03	Update Apache HTTP Server to 2.4.68.r173 for fixing the issues on ADM 5.0 and above.