CVE-2026-63686 — Apache HTTP Server: mod_xml2enc crash on charset conversion failure

CVE-2026-63686

Apache HTTP Server: mod_xml2enc crash on charset conversion failure PUBLISHED

Description (CNA)

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache HTTP Server	affected 2.4.0 through 2.4.68

CWE

CWE-476

References

https://httpd.apache.org/security/vulnerabilities_24.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/01/25