CVE-2026-43951

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when mod_headers and mod_mime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service.

This Moderate impact vulnerability in Apache HTTP Server arises from an out-of-bounds read when both mod_headers and mod_mime modules are active and configured for multiple response languages. While this configuration is not universally enabled by default in Red Hat products, affected systems could be vulnerable to information disclosure or denial of service if these specific modules and language settings are in use. Exploitation requires a remote attacker to trigger this specific module interaction.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

• Those who do not require multi-language response headers can remove or disable the mod_headers and mod_mime modules, or remove Content-Language directives from their configuration.
• Systems not using these modules in combination are not affected.