Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
* httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)
* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)
* httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)
Bug Fix(es) and Enhancement(s):
* mod_proxy_html regression in CVE-2026-34355 fix [almalinux-8.10.z] (JIRA:AlmaLinux-192751)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | httpd | 2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
| AlmaLinux · 8 | httpd-devel | 2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
| AlmaLinux · 8 | httpd-manual | 2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
| AlmaLinux · 8 | httpd-tools | 2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
| AlmaLinux · 8 | mod_http2 | 1.15.7-10.module_el8.10.0+4233+8b7d9181.7 |
| AlmaLinux · 8 | mod_ldap | 2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
| AlmaLinux · 8 | mod_md | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 |
| AlmaLinux · 8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
| AlmaLinux · 8 | mod_session | 2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
| AlmaLinux · 8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4233+8b7d9181.9 |
Vulnerabilities 10
-
Critical 9.8
Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.5
Apache HTTP Server: HTTP response splitting
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 b…
-
High 7.5
Apache HTTP Server: mod_dav_lock indirect lock crash
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was m…
-
High 7.5
Apache HTTP Server: mod_proxy_html buffer overflow
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
-
High 7.5
Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the iss…
-
High 7.5CVE-2026-42536 Public exploit
Apache HTTP Server: mod_xml2enc heap overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3CVE-2023-38709 Public exploit
Apache HTTP Server: HTTP response splitting
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.
-
High 7.3
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3
Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to…
-
Medium 6.5
Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
References
-
report
https://access.redhat.com/security/cve/CVE-2024-42516
-
report
https://access.redhat.com/security/cve/CVE-2026-29169
-
report
https://access.redhat.com/security/cve/CVE-2026-34355
-
report
https://access.redhat.com/security/cve/CVE-2026-34356
-
report
https://access.redhat.com/security/cve/CVE-2026-42536
-
report
https://access.redhat.com/security/cve/CVE-2026-43951
-
report
https://access.redhat.com/security/cve/CVE-2026-44185
-
report
https://access.redhat.com/security/cve/CVE-2026-44186
-
report
https://access.redhat.com/security/cve/CVE-2026-44631
-
report
https://bugzilla.redhat.com/2374549
-
report
https://bugzilla.redhat.com/2465296
-
report
https://bugzilla.redhat.com/2486395
-
report
https://bugzilla.redhat.com/2486397
-
report
https://bugzilla.redhat.com/2486399
-
report
https://bugzilla.redhat.com/2486402
-
report
https://bugzilla.redhat.com/2486411
-
report
https://bugzilla.redhat.com/2486414
-
report
https://bugzilla.redhat.com/2486415
-
advisory
https://errata.almalinux.org/8/ALSA-2026-42828.html