{"id":"CVE-2026-56153","published":"2026-10-01T17:17:26.487","lastModified":"2026-10-02T20:53:53.630","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-787"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/16","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache HTTP Server's mod_charset_lite module contains an out-of-bounds write vulnerability that could allow attackers to write data beyond the allocated memory buffer. This flaw is particularly concerning because it can lead to arbitrary code execution or denial of service when processing specially crafted charset conversion requests.","exploitability":"Exploitation appears moderately difficult as it likely requires precise control over input data and specific request patterns, but could be achieved with a well-crafted HTTP request that triggers the charset conversion functionality.","blast_radius":"If exploited, this vulnerability could affect any Apache HTTP Server instance running version 2.4.0 through 2.4.68 with mod_charset_lite enabled, potentially leading to complete server compromise or service disruption across all hosted web applications.","remediation":"Upgrade to Apache HTTP Server 2.4.69 or later to remediate this out-of-bounds write vulnerability in mod_charset_lite.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","memory-corruption","http-server","remote-exploitation"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:04:44.170Z"}}