CVE-2026-44631
📛 CVE Title
Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
Description
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- 9.8 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 9.8 / 10 CRITICAL source: CNA overview
- MSRC score
- 9.4 / 10 CRITICAL MS rating: Important
- CWE(s)
-
CWE-124 - Reserved
- —
- Published
- 2026-06-09 07:00 UTC
- Last updated
- 2026-06-20 01:43 UTC
- Source
- https://www.tenable.com/cve/CVE-2026-44631
- Linked Threat
- CVE-2026-44631 — CVE-2026-44631
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-06-08 16:16:40 UTC
- NVD last modified
- 2026-07-23 07:10:00 UTC
- NVD CVSS v3.1
- 9.8 / 10 CRITICAL source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0050 (probability of exploitation in next 30 days)
- EPSS percentile
- 40.36% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01
NVD / KEV / EPSS data refreshed 2026-08-01 16:30 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-35095 - Assigner
- apache
- Published
- Jun 8, 2026, 3:19:23 PM
- Updated
- Jun 8, 2026, 10:32:33 PM
- EUVD base score (CVSS 3.1)
-
9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.5000
- Vendors
- Apache Software Foundation
- Products
-
Apache HTTP Server (2.4.0 ≤2.4.67)
- Aliases
-
GHSA-9jv8-9586-5r34
ENISA description: Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
EUVD references (1)
Microsoft Security Response Center MSRC
Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-07-23 03:00 UTC (source: CVRF).
- MS severity
- Important
- MS CVSS base score
- 9.4 / 10 (temporal 8.6)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H/E:U - Release
- 2026-Jun
Affected products — CPE 2.3 (1) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- MSRC update guide: CVE-2026-44631 msrc
- http://www.openwall.com/lists/oss-security/2026/06/08/14 tenable:www.openwall.com
- https://httpd.apache.org/security/vulnerabilities_24.html tenable:httpd.apache.org
- https://nvd.nist.gov/vuln/detail/CVE-2026-44631 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-44631 tenable:www.cve.org
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- http://www.openwall.com/lists/oss-security/2026/06/08/14 af854a3a-2127-422b-91ae-364da2661108 Mailing ListThird Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html security@apache.org Vendor Advisory
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:access.redhat.com
説明 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix (es): kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel ( CVE - 2026 -46300) kernel: Read root-owned files as an unprivileged user ( CVE - 2026 -46333) For more details about the security issue ...
2026-06-19 02:37 UTC -
web:access.redhat.com
The mitigation methods below address both vulnerabilities that affect Red Hat products — CVE - 2026 -43284 (IPsec ESP) and CVE - 2026 -46300 (XFRM ESP-in-TCP). CVE - 2026 -43500 (rxrpc) does not affect Red Hat products and requires no mitigation .
2026-06-19 02:37 UTC -
web:app.opencve.io
No vendor fix or workaround currently provided. OpenCVE Recommended Actions Upgrade to Apache HTTP Server 2.4.68 or later to apply the fix . Restrict write access to configuration directories so that only trusted administrators may alter files that contain regular expression patterns. Monitor the server for abnormal crash events or memory corruption signs, and review logs for suspicious ...
2026-06-19 02:37 UTC -
web:feedly.com
Mitigation Upgrade Apache HTTP Server to version 2.4.68 or later immediately. Until patching is possible, restrict access to configuration files and carefully validate any regular expressions used in Apache HTTP Server configuration. Monitor for suspicious configuration changes or regex patterns that may be used to exploit this vulnerability.
2026-06-19 02:37 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-06-19 02:37 UTC -
web:nvd.nist.gov
Official websites use .gov A .gov website belongs to an official government organization in the United States.
2026-06-19 02:37 UTC -
web:www.linkedin.com
Microsoft has confirmed that it is developing a security update to address a newly disclosed zero-day vulnerability in Microsoft Defender, following the public release of exploit code that ...
2026-06-19 02:37 UTC -
web:www.malwarebytes.com
Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.
2026-06-19 02:37 UTC -
web:www.tenable.com
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.
2026-06-19 02:37 UTC -
web:www.thehackerwire.com
CVE-2026-44631 is a Critical severity vulnerability (CVSS 9.8). Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server:...
2026-06-19 02:37 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.