← Back to blog

Apache HTTP Server Regression Fixed in Ubuntu Update

Ubuntu addresses a critical regression in Apache HTTP Server that caused startup failures with HTTP/2 proxying. The original patch for multiple CVEs was incomplete.

TL;DR

  • Ubuntu released USN-8571-2 to fix a regression in Apache HTTP Server.
  • The previous update failed due to a missing library symbol.
  • Regression caused Apache to crash on startup when HTTP/2 proxying was enabled.
  • Original vulnerabilities included denial-of-service and HTTP response splitting risks.
  • Organizations using affected versions should apply the update immediately.

Ubuntu has issued a security update to resolve a regression in the Apache HTTP Server that was introduced in a previous patch. The earlier fix, intended to address several vulnerabilities, inadvertently led to a missing library symbol which caused the server to fail during startup when HTTP/2 proxying was enabled. This latest update corrects the issue, restoring stability while maintaining protection against the originally reported threats.

The initial vulnerabilities included denial-of-service flaws in mod_authn_socache and mod_proxy_ajp, as well as an HTTP response splitting issue affecting multiple modules. These were disclosed by researchers and assigned CVE identifiers, highlighting the importance of secure memory and string handling in web server modules.

Root Cause of the Regression

  • The initial patch for CVE-2026-33007, CVE-2026-33523, and CVE-2026-33857 was incomplete.
  • A missing library symbol caused Apache HTTP Server to fail at startup.
  • Issue specifically occurred when HTTP/2 proxying functionality was active.
  • Regression undermined the stability improvements intended by the original fixes.

Security Implications of Original Vulnerabilities

  • CVE-2026-33007: Memory handling flaw in mod_authn_socache could lead to denial of service.
  • CVE-2026-33523: HTTP response splitting vulnerability across modules with malicious backends.
  • CVE-2026-33857: Remote denial of service via improper memory operations in mod_proxy_ajp.
  • All flaws posed significant risk to web server availability and data integrity.

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.