Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)
* httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718)
* httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546)
* httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637)
* httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)
* httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292)
* httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729)
* httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636)
* httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686)
* httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005)
* httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154)
* httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153)
Bug Fix(es) and Enhancement(s):
* mod_proxy_hcheck: passing health check does not recover worker from its standard error state (PROXY_WORKER_IN_ERROR) (JIRA:RHEL-256797)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | httpd | 2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | httpd-devel | 2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | httpd-filesystem | 2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | httpd-manual | 2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | httpd-tools | 2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | mod_http2 | 1.15.7-10.module_el8.10.0+4233+8b7d9181.7 |
| AlmaLinux · 8 | mod_http2 | 1.15.7-10.module_el8.10.0+4270+e5f13fdb.7 |
| AlmaLinux · 8 | mod_ldap | 2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | mod_md | 1:2.0.8-8.module_el8.10.0+4295+280de5aa.4 |
| AlmaLinux · 8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | mod_session | 2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
| AlmaLinux · 8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4332+2bef2e0d.13 |
Vulnerabilities 12
-
Critical 9.8
Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 8.8
Apache HTTP Server: mod_dav_fs namespace overflow
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
-
High 8.1
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigge…
-
High 7.5
Apache HTTP Server: mod_heartmonitor denial of service
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_auth_digest reauthentication attack
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers w…
-
High 7.5
Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an…
-
High 7.5CVE-2026-63292 Public exploit
Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…
-
High 7.5CVE-2026-63686 Public exploit
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30…
-
High 7.3
Apache HTTP Server: mod_auth_digest DoS attack
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcC…
-
Medium 4.8CVE-2026-33006 Public exploit
Apache HTTP Server: mod_auth_digest timing attack
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
References
-
report
https://access.redhat.com/security/cve/CVE-2026-33006
-
report
https://access.redhat.com/security/cve/CVE-2026-46729
-
report
https://access.redhat.com/security/cve/CVE-2026-48005
-
report
https://access.redhat.com/security/cve/CVE-2026-56153
-
report
https://access.redhat.com/security/cve/CVE-2026-56154
-
report
https://access.redhat.com/security/cve/CVE-2026-63045
-
report
https://access.redhat.com/security/cve/CVE-2026-63292
-
report
https://access.redhat.com/security/cve/CVE-2026-63686
-
report
https://access.redhat.com/security/cve/CVE-2026-63718
-
report
https://access.redhat.com/security/cve/CVE-2026-73636
-
report
https://access.redhat.com/security/cve/CVE-2026-73637
-
report
https://access.redhat.com/security/cve/CVE-2026-93546
-
report
https://bugzilla.redhat.com/2465293
-
report
https://bugzilla.redhat.com/2544781
-
report
https://bugzilla.redhat.com/2544798
-
report
https://bugzilla.redhat.com/2544814
-
report
https://bugzilla.redhat.com/2544823
-
report
https://bugzilla.redhat.com/2544832
-
report
https://bugzilla.redhat.com/2544835
-
report
https://bugzilla.redhat.com/2544849
-
report
https://bugzilla.redhat.com/2544852
-
report
https://bugzilla.redhat.com/2544861
-
report
https://bugzilla.redhat.com/2544869
-
report
https://bugzilla.redhat.com/2544885
-
advisory
https://errata.almalinux.org/8/ALSA-2026-92616.html