Описание
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
A flaw was found in httpd's mod_charset_lite module. A heap-based buffer overflow (an out-of-bounds memory write) occurs in the finish_partial_char function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory corruption. This issue primarily results in a Denial of Service (DoS) condition by crashing the server process.
Меры по смягчению последствий
Disable the mod_charset_lite module if character set translation is not required.
- Locate the configuration file loading the module, typically within
/etc/httpd/conf.modules.d/(such as00-base.confor a dedicated module configuration file). - Comment out or remove the
LoadModule charset_lite_moduleline:
- Reload the httpd service to apply the configuration change:
Caveats: Applications that depend on mod_charset_lite for on-the-fly character set conversion will fail to translate character sets once the module is disabled. Warning: Reloading or restarting the httpd service will momentarily disrupt active network connections or in-flight requests.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | httpd | Affected | ||
| Red Hat Enterprise Linux 6 | httpd | Not affected | ||
| Red Hat Enterprise Linux 7 | httpd | Affected | ||
| Red Hat Enterprise Linux 8 | httpd:2.4/httpd | Affected | ||
| Red Hat Enterprise Linux 9 | httpd | Affected | ||
| Red Hat JBoss Core Services | jbcs-httpd24-httpd | Affected | ||
| Red Hat Hardened Images | httpd-main-2.4.69-1.hum1 | Fixed | RHSA-2026:74858 | 02.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_ ...
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
EPSS
7.5 High
CVSS3