{"id":"CVE-2026-59685","published":"2026-10-01T17:17:29.380","lastModified":"2026-10-05T13:21:03.353","description":"Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-787"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/21","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache HTTP Server on Windows contains an out-of-bounds write vulnerability when processing file paths with 8.3 names that can expand. This flaw allows attackers to write beyond allocated memory boundaries, potentially leading to arbitrary code execution or denial of service.","exploitability":"Exploitation is moderately difficult and requires a specific path traversal scenario involving 8.3 filename expansion on Windows systems, but does not require user interaction or elevated privileges.","blast_radius":"The vulnerability affects all Windows installations of Apache HTTP Server versions 2.4.0 through 2.4.68, making it potentially widespread across enterprise environments that use Windows servers.","remediation":"Upgrade to Apache HTTP Server 2.4.69 or later to remediate this out-of-bounds write vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["memory-corruption","windows","http-server","remote-exploitation"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:04:31.381Z"}}