Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | httpd | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | httpd | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 |
| AlmaLinux · 8 | httpd-devel | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | httpd-devel | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 |
| AlmaLinux · 8 | httpd-filesystem | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | httpd-manual | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | httpd-tools | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | httpd-tools | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 |
| AlmaLinux · 8 | mod_http2 | 1.15.7-10.module_el8.10.0+4190+704ad79b.6 |
| AlmaLinux · 8 | mod_ldap | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | mod_ldap | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 |
| AlmaLinux · 8 | mod_md | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 |
| AlmaLinux · 8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4190+704ad79b.8 |
| AlmaLinux · 8 | mod_session | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | mod_session | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 |
| AlmaLinux · 8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8 |
| AlmaLinux · 8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4190+704ad79b.8 |
Vulnerabilities 1
-
High 7.5
Apache HTTP Server: mod_http2 denial of service
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.