Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 6

Vulnerabilities 3

• High 7.5
  CVE-2026-29169

  Apache HTTP Server: mod_dav_lock indirect lock crash

  A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was m…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 6.5
  CVE-2026-33523

  Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

  HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 4.8
  CVE-2026-33006 Public exploit

  Apache HTTP Server: mod_auth_digest timing attack

  A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-33523
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-29169
• report
  https://access.redhat.com/security/cve/CVE-2026-33006
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17080.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465296
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-29169
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-29169
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465293
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33006
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33006
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465297
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33523
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33523