CVE-2026-63686

Apache HTTP Server denial of service in mod_xml2enc via NULL pointer flaw

high · 7.5

Fix listed

Apache HTTP Server

Published Oct 1, 2026, 16:20 UTC

Description

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Reported fixed versions

2.4.69

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.