- CVE-2026-24072: mod_rewrite/mod_setenvif: use AP_EXPR_FLAG_RESTRICTED in htaccess to prevent reading server-side files via ap_expr from .htaccess - CVE-2026-29169: mod_dav_lock: NULL pointer dereference in dav_generic_refresh_locks (use dp_scan instead of dp) - CVE-2026-33006: mod_auth_digest: timing attack — use constant-time compare for nonce/digest verification - CVE-2026-33007: mod_authn_socache: NULL pointer dereference when r->uri has no '/' in directory context - CVE-2026-33523: scan outgoing status line for newlines and control characters to prevent HTTP response splitting - CVE-2026-33857: mod_proxy_ajp: off-by-one OOB reads in ajp_msg_get/peek length checks - CVE-2026-34032: mod_proxy_ajp: improper null termination and OOB read in ajp_msg_get_string - CVE-2026-34059: mod_proxy_ajp: heap over-read in ajp_parse_data when message is too small