Question [CVE-2026-44631] Apache HTTP Server Buffer Underflow Code Execution Vulnerability

[peteeeeeee]

Server operating system version

Red Hat Enterprise Linux 9.7

Plesk version and microupdate number

Plesk Obsidian 18.0.78 Update #3

May I know if Plesk has a plan to release a fix for this?
cve report

Thanks for any advice.

 

[scsa20]

Plesk relies on the OS vendor for apache updates (recommended version is now currently 2.4.68, Debian currently only has 2.4.67, not sure what RHEL has, you should find out what you have with httpd -v or dnf info httpd). Until the OS vendor releases the update, there's a few things you can do:

1. Simplify your regex instead of using complex versions.
   • Or use non-regex alternative if possible.
2. Restrict access to limit the exposer.
   • This includes utilizing WAF (Web Application Firewalls) or reverse proxies like Cloudflare.
3. Disabled modules you don't need.
   • Not utilizing rewrite? Disable it then.
4. Where possible make sure AllowOverride is set to None to reduce .htaccess influences.

Personally I use Nginx for all my domains so my Apache exposer is pretty non-existence. Plus I think Nginx is faster (at least in my use case).