apache2 - Debian Package Tracker

general

source: apache2 (main)
version: 2.4.68-1
maintainer: Debian Apache Maintainers (archive) (DMD)
uploaders: Stefan Fritsch [DMD] – Ondřej Surý [DMD] – Arno Töll [DMD] – Bastien Roucariès [DMD] – Yadd [DMD]
arch: all any
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.4.62-1~deb11u1
o-o-sec: 2.4.67-1~deb11u3
o-o-p-u: 2.4.62-1~deb11u1
oldstable: 2.4.67-1~deb12u2
old-sec: 2.4.67-1~deb12u3
old-p-u: 2.4.68-1~deb12u1
stable: 2.4.67-1~deb13u2
stable-sec: 2.4.67-1~deb13u3
stable-p-u: 2.4.68-1~deb13u1
testing: 2.4.68-1
unstable: 2.4.68-1

versioned links

2.4.62-1~deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.67-1~deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.67-1~deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.67-1~deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.67-1~deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.67-1~deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.68-1~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.68-1~deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.68-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

apache2 (108 bugs: 1, 74, 33, 0)
apache2-bin (34 bugs: 0, 27, 7, 0)
apache2-data
apache2-dev (5 bugs: 0, 2, 3, 0)
apache2-doc (4 bugs: 0, 3, 1, 0)
apache2-ssl-dev
apache2-suexec-custom (3 bugs: 0, 2, 1, 0)
apache2-suexec-pristine (2 bugs: 0, 0, 2, 0)
apache2-utils (8 bugs: 0, 4, 4, 0)

action needed

1 bug tagged help in the BTS normal

The BTS contains 1 bug tagged help, please consider helping the maintainer in dealing with it.

Created: 2022-12-02 Last update: 2026-07-09 04:48

9 bugs tagged patch in the BTS normal

The BTS contains patches fixing 9 bugs (11 if counting merged bugs), consider including or untagging them.

Created: 2026-06-02 Last update: 2026-07-09 04:48

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 3922483c946969c265d490365595f6307cbac0ed
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Jul 7 15:48:21 2026 +0200

    Improve wording of NEWS

Created: 2026-07-07 Last update: 2026-07-07 15:30

lintian reports 21 warnings normal

Lintian reports 21 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-06-12 Last update: 2026-06-12 06:00

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2025-08-19 Last update: 2026-02-01 20:02

12 low-priority security issues in trixie low

There are 12 open security issues in trixie.

12 issues left for the package maintainer to handle:

CVE-2026-29167: (needs triaging) Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-29170: (needs triaging) A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
CVE-2026-34355: (needs triaging) A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
CVE-2026-34356: (needs triaging) Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-42535: (needs triaging) A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
CVE-2026-42536: (needs triaging) Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-43951: (needs triaging) Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
CVE-2026-44119: (needs triaging) Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-44185: (needs triaging) Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-44186: (needs triaging) Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-44631: (needs triaging) Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-48913: (needs triaging) Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-06-12 Last update: 2026-06-14 05:02

debian/patches: 4 patches to forward upstream low

Among the 10 debian patches available in version 2.4.68-1 of the package, we noticed the following issues:

4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-06-12 09:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.2).

Created: 2024-04-07 Last update: 2026-06-11 22:31

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-06-30] Accepted apache2 2.4.68-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-06-16] Accepted apache2 2.4.68-1~deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-06-14] apache2 2.4.68-1 MIGRATED to testing (Debian testing watch)
[2026-06-12] Accepted apache2 2.4.67-1~deb11u3 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-11] Accepted apache2 2.4.68-1 (source) into unstable (Xavier Guimard)
[2026-06-08] Accepted apache2 2.4.67-1~deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-06-08] Accepted apache2 2.4.67-1~deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-06-07] Accepted apache2 2.4.67-1~deb11u2 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-06] Accepted apache2 2.4.67-1~deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-06-06] Accepted apache2 2.4.67-1~deb12u3 (source) into oldstable-security (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-06-03] Accepted apache2 2.4.67-2 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-14] apache2 2.4.67-1 MIGRATED to testing (Debian testing watch)
[2026-05-08] Accepted apache2 2.4.67-1~deb11u1 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-06] Accepted apache2 2.4.67-1~deb12u2 (source amd64 all) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-05-06] Accepted apache2 2.4.67-1~deb13u2 (source amd64 all) into proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-05-06] Accepted apache2 2.4.67-1~deb13u2 (source amd64 all) into stable-security (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-05-06] Accepted apache2 2.4.67-1~deb12u2 (source amd64 all) into oldstable-security (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-05-05] Accepted apache2 2.4.67-1~deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-05-05] Accepted apache2 2.4.67-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)
[2026-05-05] Accepted apache2 2.4.67-1 (source) into unstable (Xavier Guimard)
[2026-05-02] Accepted apache2 2.4.66-1~deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-03-04] apache2 2.4.66-8 MIGRATED to testing (Debian testing watch)
[2026-03-03] Accepted apache2 2.4.66-1~deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-03-01] Accepted apache2 2.4.66-8 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-02-28] Accepted apache2 2.4.66-7 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-02-04] apache2 2.4.66-6 MIGRATED to testing (Debian testing watch)
[2026-02-01] Accepted apache2 2.4.66-6 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-01-27] apache2 2.4.66-5 MIGRATED to testing (Debian testing watch)
[2026-01-24] Accepted apache2 2.4.66-1~deb11u1 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-01-21] Accepted apache2 2.4.66-5 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)

bugs [bug history graph]

all: 173 178
RC: 1
I&N: 124 126
M&W: 48 51
F&P: 0
patch: 9 11
help: 1

links

homepage
lintian (0, 21)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.4.66-2ubuntu2