Summary
[2.4.62-13.0.1.el9_8.1]
- Replace index.html with Oracle's index page oracle_index.html.
[2.4.62-13.1]
- Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175080 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175100 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175028 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175062 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | httpd | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | httpd-core | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | httpd-devel | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | httpd-filesystem | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | httpd-manual | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | httpd-tools | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | mod_ldap | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | mod_lua | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | mod_proxy_html | 1:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | mod_session | 0:2.4.62-13.0.1.el9_8.1 |
| Oracle Linux · 9 | mod_ssl | 1:2.4.62-13.0.1.el9_8.1 |
Vulnerabilities 5
-
Critical 9.8
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…
-
High 7.5
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_authn_socache crash
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…
-
Medium 5.3
Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.