CVE-2026-59685

A flaw was found in httpd. When deployed on Windows environments, an out-of-bounds write vulnerability occurs while processing path requests containing short 8.3 file names that expand beyond allocated memory buffers. A remote attacker can exploit this flaw by sending crafted HTTP requests, potentially leading to memory corruption, a Denial of Service (DoS) via server crash, or arbitrary code execution.

This vulnerability is evaluated with an Important severity because an unauthenticated remote client could trigger memory corruption leading to a denial of service. However, Red Hat Enterprise Linux and other Red Hat platforms are not affected by this issue. The vulnerable canonical path expansion code is exclusive to Windows operating systems running on case-insensitive filesystems supporting 8.3 short filename conventions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.