CVE-2026-47360

A flaw was found in Apache HTTP Server's mod_session_cookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session tokens to backend servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If cookie-based session management is not required, disable the mod_session_cookie module.

1. Comment out the module load directive in /etc/httpd/conf.modules.d/01-session.conf (or the relevant configuration file):

# LoadModule session_cookie_module modules/mod_session_cookie.so

2. Reload the httpd service to apply the configuration:

systemctl reload httpd

Warning: Reloading or restarting the httpd service may briefly interrupt active network connections. Additionally, disabling this module will cause any web server configurations or web applications relying on mod_session_cookie to fail.