Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-core | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-core-debuginfo | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-debuginfo | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-debugsource | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-devel | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-filesystem | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-manual | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-tools | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-tools-debuginfo | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ldap | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ldap-debuginfo | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_lua | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_lua-debuginfo | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_proxy_html | 1:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_proxy_html-debuginfo | 1:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_session | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_session-debuginfo | 0:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ssl | 1:2.4.62-13.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ssl-debuginfo | 1:2.4.62-13.el9_8.1 |
Vulnerabilities 5
-
Critical 9.8
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…
-
High 7.5
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_authn_socache crash
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…
-
Medium 5.3
Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 5.3
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464940
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464952
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464953
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2465299
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2466913
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21391.json
-
report
https://access.redhat.com/security/cve/CVE-2026-28780
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-28780
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-28780
-
article
https://httpd.apache.org/security/vulnerabilities_24.html
-
report
https://access.redhat.com/security/cve/CVE-2026-33007
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-33007
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33007
-
report
https://access.redhat.com/security/cve/CVE-2026-33857
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-33857
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33857
-
report
https://access.redhat.com/security/cve/CVE-2026-34032
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34032
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34032
-
report
https://access.redhat.com/security/cve/CVE-2026-34059
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34059
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34059