CVE-2026-42356

A flaw was found in Apache HTTP Server. An attacker could achieve unintended code execution when an internal redirect generated by a Common Gateway Interface (CGI) program points to a non-executable file. If the target file resides in a directory configured for CGI execution and lacks a file extension recognized by the MIME handler, the server incorrectly treats and executes the target file as a script. This issue could allow an attacker to run unauthorized commands or code within the server context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If CGI functionality is not required, disable CGI execution by commenting out mod_cgi or mod_cgid in the Apache configuration (for example, in /etc/httpd/conf.modules.d/01-cgi.conf), or by removing ExecCGI from Options directives in /etc/httpd/conf/httpd.conf.

Apply the changes to the running service: systemctl reload httpd

Caveats: Disabling CGI modules or execution options will prevent any existing CGI applications from functioning.

Warning: Reloading or restarting the httpd service may temporarily disrupt active connections.