Summary
[2.4.63-13.0.1.el10_2.8]
- Replace index.html with Oracle's index page oracle_index.html.
[2.4.63-13.8]
- Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host
header in mod_vhost_alias (CVE-2026-63292)
- Resolves: RHEL-280355 - httpd: Denial of Service via mod_rewrite
lookahead (CVE-2026-56154)
[2.4.63-13.7]
- Resolves: RHEL-275545 CVE-2026-48005 httpd: Denial of service via forged
Authorization headers in mod_auth_digest
- Resolves: RHEL-275331 CVE-2026-73636 httpd: Authentication bypass via
credential replay in mod_auth_digest
- Resolves: RHEL-275222 CVE-2026-73637 httpd: Authentication state corruption
via concurrent Digest authentication requests
- Resolves: RHEL-275315 CVE-2026-56153 httpd: Denial of Service via heap-based
buffer overflow in mod_charset_lite
- Resolves: RHEL-275302 CVE-2026-46729 httpd: mod_heartmonitor: Denial of
Service via NULL pointer dereference
- Resolves: RHEL-275269 CVE-2026-63045 httpd: unauthorized connection to
arbitrary hosts via crafted FTP PASV response
- Resolves: RHEL-275253 CVE-2026-63292 httpd: Arbitrary code execution via
oversized Host header in mod_vhost_alias
- Resolves: RHEL-275238 CVE-2026-63686 httpd: Denial of Service via charset
conversion failure in mod_xml2enc
- Resolves: RHEL-275208 CVE-2026-93546 httpd: Denial of Service via integer
overflow in mod_dav_fs
- Resolves: RHEL-275169 CVE-2026-63718 httpd: HTTP response smuggling via
crafted Transfer-Encoding response in mod_proxy_uwsgi
[2.4.63-13.6]
- Resolves: RHEL-190812 - httpd: Apache HTTP Server: Arbitrary code execution
or denial of service via use-after-free in mod_ldap per-directory
configuration (CVE-2026-29167)
[2.4.63-13.5]
- Resolves: RHEL-192750 - mod_proxy_html regression in CVE-2026-34355 fix
[2.4.63-13.4]
- Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)
- Resolves: RHEL-186195 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via untrusted content in mod_xml2enc (CVE-2026-42536)
- Resolves: RHEL-186182 - httpd: Apache HTTP Server: Buffer overflow in
mod_proxy_html allows security bypass (CVE-2026-34355)
- Resolves: RHEL-186158 - httpd: Apache HTTP Server: Buffer Over-read via
outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
- Resolves: RHEL-184305 - httpd: Apache HTTP Server: Denial of Service via
crafted regular expressions (CVE-2026-44631)
- Resolves : RHEL-182581 - httpd: incomplete fix for
CVE-2023-38709 (CVE-2024-42516)
- Resolves: RHEL-175621 - httpd: NULL pointer dereference via specially crafted
request (CVE-2026-29169)
- Also addresses CVE-2026-44119, CVE-2026-44186, CVE-2026-42535,
CVE-2026-24072, CVE-2026-33006, CVE-2026-43951
[2.4.63-13.1]
- Resolves: RHEL-173549 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175065 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175095 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175039 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175050 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | httpd | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | httpd-core | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | httpd-devel | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | httpd-filesystem | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | httpd-manual | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | httpd-tools | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | mod_ldap | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | mod_lua | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | mod_proxy_html | 1:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | mod_session | 0:2.4.63-13.0.1.el10_2.8 |
| Oracle Linux · 10 | mod_ssl | 1:2.4.63-13.0.1.el10_2.8 |
Vulnerabilities 11
-
Critical 9.8
Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 8.8
Apache HTTP Server: mod_dav_fs namespace overflow
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
-
High 8.1
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigge…
-
High 7.5
Apache HTTP Server: mod_heartmonitor denial of service
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_auth_digest reauthentication attack
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers w…
-
High 7.5
Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an…
-
High 7.5CVE-2026-63292 Public exploit
Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…
-
High 7.5CVE-2026-63686 Public exploit
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30…
-
High 7.3
Apache HTTP Server: mod_auth_digest DoS attack
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcC…