High severity8.8NVD Advisory· Published May 4, 2026· Updated May 4, 2026

CVE-2026-24072

Description

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/HTTP Server
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Range: <2.4.67
Apache/Httpdllm-fuzzy
Range: <=2.4.66
osv-coords16 versions
pkg:bitnami/apache pkg:rpm/opensuse/apache2&distro=openSUSE%20Tumbleweed pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 2.4.67+ 15 more
- (no CPE)range: < 2.4.67
- (no CPE)range: < 2.4.67-1.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/05/04/18nvdMailing ListThird Party Advisory
httpd.apache.org/security/vulnerabilities_24.htmlnvdVendor Advisory

News mentions

Debian 13.5 point release lands with security fixes, bug patches
Help Net Security · May 17, 2026
Patch Tuesday - May 2026
Rapid7 Blog · May 13, 2026
Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Server
SecurityWeek · May 5, 2026

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000