Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)
Bug Fix(es) and Enhancement(s):
* address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | httpd | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | httpd-core | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | httpd-devel | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | httpd-filesystem | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | httpd-manual | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | httpd-tools | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | mod_ldap | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | mod_lua | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | mod_proxy_html | 1:2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | mod_session | 2.4.63-13.el10_2.4 |
| AlmaLinux · 10 | mod_ssl | 1:2.4.63-13.el10_2.4 |
Vulnerabilities 14
-
Critical 9.8
Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
Critical 9.1
Apache HTTP Server: mod_dav_fs protected directory access
A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes t…
-
High 8.8CVE-2026-24072 Public exploit
Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
-
High 7.5
Apache HTTP Server: HTTP response splitting
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 b…
-
High 7.5
Apache HTTP Server: mod_dav_lock indirect lock crash
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was m…
-
High 7.5
Apache HTTP Server: mod_proxy_html buffer overflow
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
-
High 7.5
Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the iss…
-
High 7.5CVE-2026-42536 Public exploit
Apache HTTP Server: mod_xml2enc heap overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3CVE-2023-38709 Public exploit
Apache HTTP Server: HTTP response splitting
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.
-
High 7.3
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3
Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to…
-
Medium 6.5
Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
-
Medium 5.5
Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules
Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgra…
-
Medium 4.8CVE-2026-33006 Public exploit
Apache HTTP Server: mod_auth_digest timing attack
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
References
-
report
https://access.redhat.com/security/cve/CVE-2024-42516
-
report
https://access.redhat.com/security/cve/CVE-2026-29169
-
report
https://access.redhat.com/security/cve/CVE-2026-34355
-
report
https://access.redhat.com/security/cve/CVE-2026-34356
-
report
https://access.redhat.com/security/cve/CVE-2026-42536
-
report
https://access.redhat.com/security/cve/CVE-2026-44185
-
report
https://access.redhat.com/security/cve/CVE-2026-44631
-
report
https://bugzilla.redhat.com/2374549
-
report
https://bugzilla.redhat.com/2465296
-
report
https://bugzilla.redhat.com/2486395
-
report
https://bugzilla.redhat.com/2486397
-
report
https://bugzilla.redhat.com/2486399
-
report
https://bugzilla.redhat.com/2486411
-
report
https://bugzilla.redhat.com/2486414
-
advisory
https://errata.almalinux.org/10/ALSA-2026-34109.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-24072.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-33006.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-42535.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-43951.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-44119.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-44186.html