Submit finding

All findings

CVE-2026-34356 + 5 more medium

Apache httpd 2.4.68 credits DepthFirst across six additional CVEs

Apache's upstream security page credits DepthFirst researchers on six vulnerabilities spanning request handling, modules, and memory safety in the 2.4.68 release.

Bug class
Request-processing, module-boundary, denial-of-service, and memory-safety flaws
Affected codebase
Apache HTTP Server
Credited system
DepthFirst
Disclosed
June 8, 2026
Attribution
Self-reported attribution
Severity
medium
Source status: Apache directly credits DepthFirst researchers on all six accepted CVEs. DepthFirst's own materials establish that its autonomous analysis platform produced the reports. The cluster uses Medium, the maximum of Apache's three Low and three Moderate ratings.

Summary

Apache HTTP Server 2.4.68 contains six additional CVEs credited to DepthFirst, separate from the shared CVE-2026-44631 page. The release demonstrates that the platform’s public record extends beyond NGINX and FFmpeg into another mature, internet-facing C codebase.

Apache rates CVE-2026-34356, CVE-2026-42536, and CVE-2026-44185 Low, and CVE-2026-42535, CVE-2026-43951, and CVE-2026-44186 Moderate. Bugflation maps the cluster maximum to Medium; none of the six is upstream-rated High.

Attribution boundary

Apache confirms the accepted vulnerabilities and researchers. The autonomous AI-system role comes from DepthFirst, so Bugflation retains the self-reported label rather than upgrading the platform claim solely from the company credit.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.