High RHSA-2026:0074 1 CVE

Red Hat Security Advisory: httpd security update

Published Jan 6, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 6

Release	Package	Fixed in
Red Hat · RHEL 6 ELS rhel_els:6	httpd	0:2.2.15-71.el6_10.2
Red Hat · RHEL 6 ELS rhel_els:6	httpd-debuginfo	0:2.2.15-71.el6_10.2
Red Hat · RHEL 6 ELS rhel_els:6	httpd-devel	0:2.2.15-71.el6_10.2
Red Hat · RHEL 6 ELS rhel_els:6	httpd-manual	0:2.2.15-71.el6_10.2
Red Hat · RHEL 6 ELS rhel_els:6	httpd-tools	0:2.2.15-71.el6_10.2
Red Hat · RHEL 6 ELS rhel_els:6	mod_ssl	1:2.2.15-71.el6_10.2

Vulnerabilities 1

High 8.3

CVE-2025-58098 Public exploit

Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Dec 5, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2419365
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0074.json
report
https://access.redhat.com/security/cve/CVE-2025-58098
advisory
https://www.cve.org/CVERecord?id=CVE-2025-58098
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-58098
article
https://httpd.apache.org/security/vulnerabilities_24.html