CVE-2026-63686

A flaw was found in the mod_xml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service (DoS) by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access (null pointer dereference), causing the server process to crash.

Red Hat has rated this vulnerability as Important severity because an untrusted upstream system can remotely terminate the web server worker process, creating a denial of service across active client connections without requiring host privileges. The risk is primarily present in reverse-proxy architectures where mod_xml2enc is actively filtering and transcoding HTTP responses. Typical web server configurations that do not forward requests through this module or that only interface with trusted internal origin servers face significantly reduced operational exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If proxy character set transcoding is not required, disable the mod_xml2enc module by commenting out its configuration directive.

1. Edit the module configuration file (typically located under /etc/httpd/conf.modules.d/) and comment out the loading directive:

   LoadModule xml2enc_module modules/mod_xml2enc.so

2. Verify the configuration syntax: httpd -t

3. Reload the Apache HTTP Server to apply changes: systemctl reload httpd

Caveats: Disabling mod_xml2enc will break modules that depend on XML or HTML character set conversion, such as mod_proxy_html. If this module is required, restrict proxy rules so httpd communicates only with trusted upstream backends.

Warning: Reloading or restarting the httpd service may cause a brief interruption to active connections.