Описание
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in the mod_xml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service (DoS) by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access (null pointer dereference), causing the server process to crash.
Меры по смягчению последствий
If proxy character set transcoding is not required, disable the mod_xml2enc module by commenting out its configuration directive.
- Edit the module configuration file (typically located under
/etc/httpd/conf.modules.d/) and comment out the loading directive:
LoadModule xml2enc_module modules/mod_xml2enc.so
- Verify the configuration syntax: httpd -t
- Reload the Apache HTTP Server to apply changes: systemctl reload httpd Caveats: Disabling mod_xml2enc will break modules that depend on XML or HTML character set conversion, such as mod_proxy_html. If this module is required, restrict proxy rules so httpd communicates only with trusted upstream backends. Warning: Reloading or restarting the httpd service may cause a brief interruption to active connections.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | httpd | Affected | ||
| Red Hat Enterprise Linux 6 | httpd | Not affected | ||
| Red Hat Enterprise Linux 7 | httpd | Affected | ||
| Red Hat Enterprise Linux 8 | httpd:2.4/httpd | Affected | ||
| Red Hat JBoss Core Services | jbcs-httpd24-httpd | Affected | ||
| Red Hat Enterprise Linux 9 | httpd | Fixed | RHSA-2026:88229 | 22.10.2026 |
| Red Hat Hardened Images | httpd-main-2.4.69-1.hum1 | Fixed | RHSA-2026:74858 | 02.10.2026 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in mod_xml2enc in Apache Software Foundatio ...
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
7.5 High
CVSS3