CVE-2026-42536: Apache HTTP Server: mod_xml2enc heap overflow

Synopsis

A heap-based buffer overflow affects Apache HTTP Server versions 2.4.0 through 2.4.67 when the mod_xml2enc module is enabled and processes untrusted content via the xml2StartParse function. The vulnerability is reachable over the network with no authentication required and no victim interaction needed. Successful exploitation crashes the affected HTTP server process, causing a denial of service. No fix versions have been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as Apache ships a release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Apache HTTP Server over the network by sending a crafted request; no local access or special positioning is needed.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable code path is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  The server processes the malicious content autonomously; no user or administrator action is required to trigger the overflow.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory-layout knowledge, or environmental dependency is required.

Blast Radius

• Crashes the Apache HTTP Server worker process handling the malicious request, taking the service offline or degrading availability for all clients.
• Repeated requests can sustain a denial-of-service condition, preventing the server from serving any legitimate traffic until the process is restarted.