Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
* httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
* httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
* httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
* Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | httpd | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | httpd-core | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | httpd-devel | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | httpd-filesystem | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | httpd-manual | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | httpd-tools | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | mod_ldap | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | mod_lua | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | mod_proxy_html | 1:2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | mod_session | 2.4.62-13.el9_8.1 |
| AlmaLinux · 9 | mod_ssl | 1:2.4.62-13.el9_8.1 |
Vulnerabilities 5
-
Critical 9.8
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…
-
High 7.5
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_authn_socache crash
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…
-
Medium 5.3
Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
References
-
report
https://access.redhat.com/security/cve/CVE-2026-28780
-
report
https://access.redhat.com/security/cve/CVE-2026-33007
-
report
https://access.redhat.com/security/cve/CVE-2026-33857
-
report
https://access.redhat.com/security/cve/CVE-2026-34032
-
report
https://access.redhat.com/security/cve/CVE-2026-34059
-
report
https://bugzilla.redhat.com/2464940
-
report
https://bugzilla.redhat.com/2464952
-
report
https://bugzilla.redhat.com/2464953
-
report
https://bugzilla.redhat.com/2465299
-
report
https://bugzilla.redhat.com/2466913
-
advisory
https://errata.almalinux.org/9/ALSA-2026-21391.html