A series of vulnerabilities affecting the Apache HTTP Server have been disclosed, impacting multiple versions of Ubuntu Long Term Support (LTS). These vulnerabilities were identified in October 2026 and have been tracked under several CVEs, including CVE-2026-46729, CVE-2026-47360, and CVE-2026-56153.
The vulnerabilities involve improper handling of memory operations, session cookies, and forms of authentication. They potentially allow for denial of service attacks and information leaks. The Common Vulnerability Scoring System (CVSS) scores for these vulnerabilities range from 5.3 to 9.8, indicating varying levels of severity.
Affected versions include Ubuntu 14.04 LTS through 26.10. The vulnerabilities were discovered by researchers such as Zhen Kong and Lucian Nitescu.
To address these issues, updates were released on November 10, 2026. No exploitation of these vulnerabilities has been reported.