Summary
[2.4.63-13.0.1.el10_2.4]
- Replace index.html with Oracle's index page oracle_index.html.
[2.4.63-13.4]
- Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)
- Resolves: RHEL-186195 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via untrusted content in mod_xml2enc (CVE-2026-42536)
- Resolves: RHEL-186182 - httpd: Apache HTTP Server: Buffer overflow in
mod_proxy_html allows security bypass (CVE-2026-34355)
- Resolves: RHEL-186158 - httpd: Apache HTTP Server: Buffer Over-read via
outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
- Resolves: RHEL-184305 - httpd: Apache HTTP Server: Denial of Service via
crafted regular expressions (CVE-2026-44631)
- Resolves : RHEL-182581 - httpd: incomplete fix for
CVE-2023-38709 (CVE-2024-42516)
- Resolves: RHEL-175621 - httpd: NULL pointer dereference via specially crafted
request (CVE-2026-29169)
- Also addresses CVE-2026-44119, CVE-2026-44186, CVE-2026-42535,
CVE-2026-24072, CVE-2026-33006, CVE-2026-43951
[2.4.63-13.1]
- Resolves: RHEL-173549 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175065 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175095 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175039 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175050 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | httpd | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | httpd-core | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | httpd-devel | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | httpd-filesystem | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | httpd-manual | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | httpd-tools | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | mod_ldap | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | mod_lua | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | mod_proxy_html | 1:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | mod_session | 0:2.4.63-13.0.1.el10_2.4 |
| Oracle Linux · 10 | mod_ssl | 1:2.4.63-13.0.1.el10_2.4 |
Vulnerabilities 5
-
Critical 9.8
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…
-
High 7.5
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_authn_socache crash
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…
-
Medium 5.3
Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.