Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 6

Vulnerabilities 6

• High 8.8
  CVE-2026-23918 Public exploit EPSS 50%

  Apache HTTP Server: http2: double free and possible RCE on early reset

  Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 8.8
  CVE-2026-24072 Public exploit

  Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

  An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.5
  CVE-2026-34059

  Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

  Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-33007

  Apache HTTP Server: mod_authn_socache crash

  A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-33857

  Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

  Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-34032

  Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

  Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-23918
• report
  https://access.redhat.com/security/cve/CVE-2026-24072
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-34032
• report
  https://access.redhat.com/security/cve/CVE-2026-33007
• report
  https://access.redhat.com/security/cve/CVE-2026-34059
• report
  https://access.redhat.com/security/cve/CVE-2026-33857
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13938.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23918
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464941
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-24072
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-24072
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465299
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33007
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464953
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464952
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34032
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34032
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464940
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34059