CVE-2026-42536

A flaw was found in Apache HTTP Server, specifically within the mod_xml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service, information disclosure, or possibly arbitrary code execution.

In Red Hat Enterprise Linux (RHEL), the httpd package includes mod_xml2enc, which provides encoding support for filters like mod_proxy_html. Because this flaw relies on processing unvetted or untrusted input text lengths, the impact presents a high risk to availability (Denial of Service via worker crashes) and a potential risk to confidentiality if an attacker is capable of executing remote code within the context of the apache or httpd daemon process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the mod_xml2enc module if its functionality for XML internationalization is not essential. This can be done by commenting out the LoadModule xml2enc_module modules/mod_xml2enc.so directive in the Apache HTTP Server configuration. A service restart is required for the change to take effect.

# Edit the Apache configuration file, e.g., /etc/httpd/conf.modules.d/00-base.conf
# Comment out the line:
# LoadModule xml2enc_module modules/mod_xml2enc.so

# Reload the httpd service
sudo systemctl reload httpd

Note: Disabling mod_xml2enc will cause any configurations relying heavily on mod_proxy_html or raw HTML/XML encoding conversions to function incorrectly or fail. Red Hat strongly recommends upgrading to a patched version of httpd as soon as it becomes available for your specific RHEL channel.