CVE-2026-42356: Apache HTTP Server RCE Vulnerability

CVE-2026-42356 Overview

CVE-2026-42356 is a deployment of wrong handler vulnerability in Apache HTTP Server affecting versions 2.4.60 through 2.4.68. The flaw allows the target of certain internal redirects originating from Common Gateway Interface (CGI) programs to be treated as CGI and executed by the server. For exploitation to occur, the redirect target must already reside in a directory configured for CGI execution and must lack any other extension recognized by mod_mime.

The vulnerability is tracked under CWE-430: Deployment of Wrong Handler. It carries a limited integrity impact and requires specific server configurations to be exploitable.

Critical Impact

An attacker able to influence CGI internal redirect targets could cause unintended files within a CGI-enabled directory to be executed as CGI scripts, altering server response content.

Affected Products

• Apache HTTP Server 2.4.60
• Apache HTTP Server versions 2.4.61 through 2.4.67
• Apache HTTP Server 2.4.68

Discovery Timeline

• 2026-10-01 - CVE CVE-2026-42356 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-42356

Vulnerability Analysis

The vulnerability resides in how Apache HTTP Server processes internal redirects produced by CGI programs. When a CGI script emits an internal redirect via a Location: header pointing to a server-local path, the server resolves the redirect and selects a handler for the new target. Under the affected versions, the server incorrectly carries forward the CGI handler assignment to the redirect target when that target has no extension mapped by mod_mime.

As a result, a file sitting in a CGI-enabled directory that would normally be served as static content can be executed as a CGI script. The impact is bounded by the configuration requirement that both the source and redirect target reside in a ScriptAlias or Options +ExecCGI directory.

Root Cause

The root cause is improper handler reassignment during the internal redirect subrequest. The server fails to re-evaluate whether the redirected resource should be dispatched through mod_cgi or mod_cgid. Instead, the CGI handler persists across the subrequest, bypassing the normal mod_mime type-and-handler negotiation. This classifies the issue under CWE-430.

Attack Vector

Exploitation requires an existing CGI program that performs an internal redirect to an attacker-influenced path within the same CGI-enabled directory. The attacker cannot execute arbitrary files outside this directory, and the target file must lack a recognized extension such as .html, .txt, or .jpg. Network access to the vulnerable server is required, and no authentication is needed.

Because the attack preconditions are narrow and attack complexity is high, practical exploitation depends on application-specific CGI logic. The vulnerability does not grant direct remote code execution unless an attacker can also place or control the contents of a file in the CGI-enabled directory.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Apache HTTP Server Vulnerabilities page for official technical details.

Detection Methods for CVE-2026-42356

Indicators of Compromise

• Unexpected execution of extensionless files located in directories configured with ScriptAlias or Options +ExecCGI.
• CGI access log entries showing requests that resolve to files without known MIME extensions returning dynamic content.
• Internal redirect responses from CGI scripts referencing paths outside normal application flow.

Detection Strategies

• Audit Apache configuration for all directories with CGI execution enabled and enumerate every file within them, flagging any lacking a recognized extension.
• Review CGI source code for Location: headers that construct redirect targets from user-controlled input.
• Compare the installed httpd version against the affected range 2.4.60 through 2.4.68 using httpd -v or apachectl -v.

Monitoring Recommendations

• Enable verbose Apache access and error logging with LogLevel info to capture subrequest activity and handler assignments.
• Alert on HTTP responses from CGI-enabled paths that return Content-Type: text/html for resources expected to be static.
• Correlate CGI invocation events with file-integrity monitoring on CGI directories to detect new or modified extensionless files.

How to Mitigate CVE-2026-42356

Immediate Actions Required

• Upgrade Apache HTTP Server to a version beyond 2.4.68 that includes the fix published by the Apache Software Foundation.
• Inventory all ScriptAlias and ExecCGI directories and remove any files not intended to be served or executed.
• Review CGI programs for internal redirect logic that incorporates untrusted input into the target path.

Patch Information

The Apache HTTP Server project has addressed this issue in a release following 2.4.68. Refer to the Apache HTTP Server Vulnerabilities advisory page for the exact fixed version and changelog entries. Administrators should apply the vendor patch through their distribution's package manager or by rebuilding from source using the fixed release tarball.

Workarounds

• Restrict CGI-enabled directories so they contain only intended executable scripts with recognized extensions such as .cgi or .pl.
• Add explicit AddType or AddHandler directives in mod_mime for any file types present in CGI directories to force correct handler selection.
• Disable mod_cgi and mod_cgid entirely if CGI functionality is not required by the hosted applications.

# Configuration example: restrict CGI execution to a specific script extension
<Directory "/var/www/cgi-bin">
    Options +ExecCGI
    AddHandler cgi-script .cgi .pl
    Require all granted
</Directory>

# Verify installed version against affected range
httpd -v