Apache HTTP Server regression
Published: Fri, 29 May 2026 10:47
Summary
USN-8338-1 introduced a regression in Apache HTTP Server
Details
USN-8338-1 fixed vulnerabilities in Apache HTTP Server. The update introduced a regression that prevented mod_http2 from loading on Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-38709) Will Dormann and David Warren discovered that Apache HTTP Server's HTTP/2 implementation did not properly reclaim memory when streams were reset by clients. A remote attacker could possibly use this issue to cause Apache HTTP Server to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-45802) Keran Mu and Jianjun Chen discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-24795) Orange Tsai discovered that Apache HTTP Server mod_proxy incorrectly handled URL encoding. A remote attacker could possibly use this issue to bypass authentication via crafted requests. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-38473) Orange Tsai discovered that Apache HTTP Server could be caused to perform server-side request forgery (SSRF) via malicious backend response headers. A remote attacker could possibly use this issue to conduct SSRF attacks or disclose sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38476) Orange Tsai discovered that Apache HTTP Server mod_proxy did not properly handle certain null pointer conditions. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38477) Orange Tsai discovered that Apache HTTP Server mod_rewrite could be made to perform server-side request forgery (SSRF) via unsafe RewriteRules. A remote attacker could possibly use this issue to conduct SSRF attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-39573) It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-42516) It was discovered that Apache HTTP Server could be caused to perform server-side request forgery (SSRF) via mod_headers modifying Content-Type headers. A remote attacker could possibly use this issue to conduct SSRF attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-43204) John Runyon discovered that Apache HTTP Server mod_ssl did not properly escape user-supplied data before writing log entries. A remote attacker could possibly use this issue to insert escape sequences into log files. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-47252) Robert Merget discovered that Apache HTTP Server with SSLEngine optional was vulnerable to HTTP desynchronisation attacks. An attacker in a privileged network position could possibly use this issue to hijack HTTP sessions. This issue only affected Ubuntu 14.04 LTS. (CVE-2025-49812) It was discovered that Apache HTTP Server mod_md had an integer overflow in the ACME certificate renewal backoff timer. An attacker could possibly use this issue to cause excessive certificate renewal requests. This issue only affected Ubuntu 20.04 LTS. (CVE-2025-55753) Anthony Parfenov discovered that Apache HTTP Server with SSI enabled and mod_cgid passed shell-escaped query strings to #exec cmd directives. A remote attacker could possibly use this issue to perform command injection. (CVE-2025-58098) Mattias Åsander discovered that Apache HTTP Server incorrectly gave precedence to environment variables from HTTP headers over server-calculated CGI variables. A remote attacker could possibly use this issue to influence the environment of CGI programs. (CVE-2025-65082) Mattias Åsander discovered that Apache HTTP Server mod_userdir with suexec could be caused to run CGI scripts under an unexpected user ID via RequestHeader directives in .htaccess files. An attacker with .htaccess write access could possibly use this issue to bypass suexec user restrictions. (CVE-2025-66200)
Recommended actions per Ubuntu release
StackPatch playbook auto-generated per release codename and per affected package.
Ubuntu bionic
apache2→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-bin→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-bin
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-data→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-data
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-dev→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-dev
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-doc→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-doc
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-ssl-dev→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-ssl-dev
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-suexec-custom→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-suexec-custom
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-suexec-pristine→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-suexec-pristine
Most apt upgrades restart their service automatically. needrestart lists anything else.
apache2-utils→2.4.29-1ubuntu4.27+esm8apt_upgradeStandard apt upgrade. Install 2.4.29-1ubuntu4.27+esm8 from the apt repo.
sudo apt-get update sudo apt-get install --only-upgrade -y apache2-utils
Most apt upgrades restart their service automatically. needrestart lists anything else.
Are YOU affected by USN-8338-2?
5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether USN-8338-2 (and any other live CVE) applies. Anonymous, no signup.
curl https://mindsparkstack.com/scan.sh | bash
References
StackPatch runs this match against YOUR installed packages every hour
Free 1-server / $99 lifetime founder seat (50 only) / $19+/mo monthly. Indie pricing.