Summary
[2.4.62-13.0.1.el9_8.9]
- Replace index.html with Oracle's index page oracle_index.html.
[2.4.62-13.9]
- Related: RHEL-275261 - httpd: Arbitrary code execution via oversized Host
header in mod_vhost_alias (CVE-2026-63292)
- Resolves: RHEL-280369 - httpd: Denial of Service via mod_rewrite
lookahead (CVE-2026-56154)
[2.4.62-13.7]
- Resolves: RHEL-275551 CVE-2026-48005 httpd: Denial of service via forged
Authorization headers in mod_auth_digest
- Resolves: RHEL-275338 CVE-2026-73636 httpd: Authentication bypass via
credential replay in mod_auth_digest
- Resolves: RHEL-275229 CVE-2026-73637 httpd: Authentication state corruption
via concurrent Digest authentication requests
- Resolves: RHEL-275323 CVE-2026-56153 httpd: Denial of Service via heap-based
buffer overflow in mod_charset_lite
- Resolves: RHEL-275307 CVE-2026-46729 httpd: mod_heartmonitor: Denial of
Service via NULL pointer dereference
- Resolves: RHEL-275276 CVE-2026-63045 httpd: unauthorized connection to
arbitrary hosts via crafted FTP PASV response
- Resolves: RHEL-275261 CVE-2026-63292 httpd: Arbitrary code execution via
oversized Host header in mod_vhost_alias
- Resolves: RHEL-275245 CVE-2026-63686 httpd: Denial of Service via charset
conversion failure in mod_xml2enc
- Resolves: RHEL-275214 CVE-2026-93546 httpd: Denial of Service via integer
overflow in mod_dav_fs
- Resolves: RHEL-275176 CVE-2026-63718 httpd: HTTP response smuggling via
crafted Transfer-Encoding response in mod_proxy_uwsgi
[2.4.62-13.6]
- Resolves: RHEL-190807 - httpd: use-after-free in mod_ldap
uldap_connection_find via per-directory client cert list
(CVE-2026-29167)
[2.4.62-13.5]
- Resolves: RHEL-192752 - mod_proxy_html regression in CVE-2026-34355 fix
[2.4.62-13.4]
- Resolves: RHEL-186217 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)
- Resolves: RHEL-182578 - httpd: incomplete fix
for CVE-2023-38709 (CVE-2024-42516)
- Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-43951,
CVE-2026-44119, CVE-2026-44186
[2.4.62-13.3]
- Resolves: RHEL-186186 - httpd: mod_proxy_html buffer handling
vulnerability (CVE-2026-34355)
- Resolves: RHEL-175636 - httpd: mod_dav_lock uses wrong lock discovery
(CVE-2026-29169)
- Resolves: RHEL-186196 - mod_xml2enc: fix bblen accounting in fix_skipto
(CVE-2026-42536)
- Resolves: RHEL-186164 - httpd: fix OCSP write buffer advancement
bug in mod_ssl (CVE-2026-44185)
[2.4.62-13.2]
- Resolves: RHEL-184312 - httpd: ap_regname restrict to reasonable captures
(CVE-2026-44631)
[2.4.62-13.1]
- Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175080 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175100 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175028 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175062 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | httpd | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | httpd-core | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | httpd-devel | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | httpd-filesystem | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | httpd-manual | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | httpd-tools | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | mod_ldap | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | mod_lua | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | mod_proxy_html | 1:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | mod_session | 0:2.4.62-13.0.1.el9_8.9 |
| Oracle Linux · 9 | mod_ssl | 1:2.4.62-13.0.1.el9_8.9 |
Vulnerabilities 11
-
Critical 9.8
Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 8.8
Apache HTTP Server: mod_dav_fs namespace overflow
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
-
High 8.1
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigge…
-
High 7.5
Apache HTTP Server: mod_heartmonitor denial of service
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_auth_digest reauthentication attack
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers w…
-
High 7.5
Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an…
-
High 7.5CVE-2026-63292 Public exploit
Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…
-
High 7.5CVE-2026-63686 Public exploit
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30…
-
High 7.3
Apache HTTP Server: mod_auth_digest DoS attack
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcC…