Three vulnerabilities in Apache HTTP Server require immediate patching: a critical memory handling flaw in mod_ldap (CVE-2026-29167, CVSS 9.8) allowing RCE or DoS, a medium-severity script injection in mod_proxy_ftp's FTP directory listings (CVE-2026-29170, CVSS 6.1), and a medium-severity timing attack against mod_auth_digest (CVE-2026-33006, CVSS 4.8) to bypass authentication. Affected versions are Apache HTTP Server 2.4.0 through 2.4.67 for the critical and digest flaws, and all versions prior to 2.4.68 for the FTP flaw. The fixed versions are 2.4.68 for CVE-2026-29167 and CVE-2026-29170, and 2.4.67 for CVE-2026-33006.
It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-29167) It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170) Nitescu Lucian discovered that Apache HTTP Server's mod_auth_digest module was vulnerable to a timing attack. A remote attacker could possibly use this issue to bypass Digest authentication. (CVE-2026-33006)