CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Remote code execution flaws patched in Apache HTTP Server and MINA frameworks

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Apache released security updates on May 5, 2026 addressing multiple vulnerabilities across Apache HTTP Server 2.4.67 and MINA 2.2.7/2.1.12, including critical and high-severity issues enabling remote code execution (RCE), denial-of-service (DoS), information disclosure, and authentication bypass. The HTTP Server patch addresses 11 vulnerabilities, with five enabling code execution or DoS conditions and four allowing information disclosure. The MINA update resolves two critical-sequence flaws stemming from incomplete fixes in prior releases, requiring explicit class allowlisting for the ObjectSerializationDecoder to prevent insecure deserialization attacks.

Timeline

  1. 05.05.2026 14:19 1 articles · 15h ago

    Apache releases security updates for HTTP Server and MINA with critical RCE fixes

    Apache released HTTP Server 2.4.67 and MINA 2.2.7/2.1.12 on May 5, 2026, addressing 11 and 2 vulnerabilities respectively. The HTTP Server patch mitigates HTTP/2 double-free (CVE-2026-23918), AJP heap overflow (CVE-2026-28780), and multiple DoS/information disclosure issues. MINA fixes include critical insecure deserialization (CVE-2026-42778) and allowlist bypass (CVE-2026-42779) flaws requiring explicit class allowlisting for ObjectSerializationDecoder instances.

    Show sources
    Open in new tab

Information Snippets