Ubuntu Patches Apache HTTP Server Across Supported Security Streams
Tech GuruQuick Answer
Apply the apache2 security packages for each Ubuntu suite. Validate loaded modules, configuration and application traffic, then ensure workers use the corrected binaries.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Ubuntu suite, installed apache2 packages, repository origin, active consumers and owners. Match the installed suite and package to the official notice; assess upstream or bundled copies separately. Install the listed security packages through the supported Ubuntu repositories. Confirm required Ubuntu Pro, ESM or Legacy Support entitlements for older suites. Run configuration checks and test HTTP/2, WebDAV, managed certificates and CGI paths where enabled. Retain package output, module inventory and service-health results.
Last verified: 2026-11-13 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Apache HTTP Server modules on the Ubuntu releases listed in USN-9090-1 |
|---|---|
| Advisory | USN-9090-1 |
| CVEs | CVE-2026-106023, CVE-2026-109163, CVE-2026-119618, CVE-2026-42356, CVE-2026-42528 |
| Authoritative release date | 2026-11-12 — November 12, 2026 at 21:25:57 UTC, from the official Ubuntu security feed; the notice gives the same date. |
| Authority revision date | No separate revision date is provided by the authority. |
| Affected versions | Ubuntu apache2 packages on the suites listed in the fixed-version table, before their respective security updates. Applicability is package-, feature- and suite-specific. |
| Fixed version | 26.10: 2.4.68-1ubuntu6.2; 26.04 LTS: 2.4.66-2ubuntu2.8; 24.04 LTS: 2.4.58-1ubuntu8.19; 22.04 LTS: 2.4.52-1ubuntu4.27; 20.04 LTS: 2.4.41-4ubuntu3.23+esm11; 18.04 LTS: 2.4.29-1ubuntu4.27+esm15; 16.04 LTS: 2.4.18-2ubuntu3.17+esm24; 14.04 LTS: 2.4.7-1ubuntu4.22+esm19. These versions apply to the listed apache2, apache2-bin and apache2-dev packages. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | The Ubuntu notice does not confirm exploitation in the wild.; no exploitation claim is inferred. |
What Changed
Ubuntu fixes WebDAV lock handling, virtual-host alias, managed-certificate, HTTP/2 and CGI redirect issues. Effects include denial of service and possible code execution.
What To Validate Now
- Inventory. Inventory Ubuntu suite, installed apache2 packages, repository origin, active consumers and owners.
- Establish applicability. Match the installed suite and package to the official notice; assess upstream or bundled copies separately.
- Remediate. Install the listed security packages through the supported Ubuntu repositories. Confirm required Ubuntu Pro, ESM or Legacy Support entitlements for older suites.
- Validate. Run configuration checks and test HTTP/2, WebDAV, managed certificates and CGI paths where enabled. Retain package output, module inventory and service-health results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CVE-2026-106023 and CVE-2026-119618 apply only to the listed Ubuntu 20.04–26.10 releases; CVE-2026-42356 applies only to 26.04 and 26.10. Use the suite-specific matrix and preserve a tested service recovery path.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
