Summary
httpd
[2.4.37-65.0.1.7]
- Replace index.html with Oracle's index page oracle_index.html
mod_http2
[1.15.7-10.5]
- Resolves: RHEL-166277 - httpd:2.4/httpd: Apache HTTP Server: HTTP/2 DoS by
Memory Increase (CVE-2025-53020)
mod_md
[1:2.0.8-8.2]
- Resolves: RHEL-134487 - httpd:2.4/httpd: Apache HTTP Server: mod_md (ACME),
unintended retry intervals (CVE-2025-55753)
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | httpd | 0:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | httpd-devel | 0:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | httpd-filesystem | 0:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | httpd-manual | 0:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | httpd-tools | 0:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+90899+db89cbcc.5 |
| Oracle Linux · 8 | mod_ldap | 0:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | mod_md | 1:2.0.8-8.module+el8.10.0+90899+db89cbcc.2 |
| Oracle Linux · 8 | mod_proxy_html | 1:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | mod_session | 0:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
| Oracle Linux · 8 | mod_ssl | 1:2.4.37-65.0.1.module+el8.10.0+90899+db89cbcc.7 |
Vulnerabilities 6
-
Critical 9.8
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…
-
High 7.5CVE-2025-53020 Public exploit
Apache HTTP Server: HTTP/2 DoS by Memory Increase
Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.
-
High 7.5
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_authn_socache crash
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…
-
Medium 5.3
Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.