{"id":"CVE-2026-63686","published":"2026-10-01T17:17:29.923","lastModified":"2026-10-05T17:46:24.750","description":"A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-476"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/25","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A NULL pointer dereference vulnerability in Apache HTTP Server's mod_xml2enc module allows untrusted backend servers to trigger a denial of service condition when processing proxied responses with problematic charset conversions. This can lead to server crashes and unavailability.","exploitability":"Exploitation requires an untrusted backend server to send a specially crafted proxied response with a charset conversion that partially succeeds then fails, making it moderately difficult to achieve in practice but possible with a compromised or malicious backend.","blast_radius":"The impact is significant as the vulnerability affects all platforms and allows for complete denial of service, potentially causing widespread availability issues for web applications relying on Apache HTTP Server's proxy functionality.","remediation":"Upgrade to Apache HTTP Server 2.4.69 which fixes this NULL pointer dereference issue in mod_xml2enc.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","proxy","apache","http-server"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:04:12.824Z"}}