RHSA-2026:22140 — Red Hat Security Advisory: httpd:2.4 security update

Fixed packages 22

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-debuginfo	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-debugsource	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-devel	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-filesystem	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-manual	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-tools	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-tools-debuginfo	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_http2	0:1.15.7-10.module+el8.10.0+24315+35fe59d0.5
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_http2-debuginfo	0:1.15.7-10.module+el8.10.0+24315+35fe59d0.5
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_http2-debugsource	0:1.15.7-10.module+el8.10.0+24315+35fe59d0.5
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ldap	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ldap-debuginfo	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_md	1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_md-debuginfo	1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_md-debugsource	1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_proxy_html	1:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_proxy_html-debuginfo	1:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_session	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_session-debuginfo	0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ssl	1:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ssl-debuginfo	1:2.4.37-65.module+el8.10.0+24281+ea10630c.8

Vulnerabilities 6

Critical 9.8

CVE-2026-28780

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

May 5, 2026
High 7.5

CVE-2025-53020 Public exploit

Apache HTTP Server: HTTP/2 DoS by Memory Increase

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Jul 10, 2025
High 7.5

CVE-2026-34059

Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

May 4, 2026
Medium 5.3

CVE-2026-33007

Apache HTTP Server: mod_authn_socache crash

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

May 4, 2026
Medium 5.3

CVE-2026-33857

Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

May 4, 2026
Medium 5.3

CVE-2026-34032

Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

May 4, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2379343
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464940
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464952
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464953
report
https://bugzilla.redhat.com/show_bug.cgi?id=2465299
report
https://bugzilla.redhat.com/show_bug.cgi?id=2466913
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22140.json
report
https://access.redhat.com/security/cve/CVE-2025-53020
advisory
https://www.cve.org/CVERecord?id=CVE-2025-53020
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-53020
article
https://httpd.apache.org/security/vulnerabilities_24.html
report
https://access.redhat.com/security/cve/CVE-2026-28780
advisory
https://www.cve.org/CVERecord?id=CVE-2026-28780
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-28780
report
https://access.redhat.com/security/cve/CVE-2026-33007
advisory
https://www.cve.org/CVERecord?id=CVE-2026-33007
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33007
report
https://access.redhat.com/security/cve/CVE-2026-33857
advisory
https://www.cve.org/CVERecord?id=CVE-2026-33857
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33857
report
https://access.redhat.com/security/cve/CVE-2026-34032
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34032
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34032
report
https://access.redhat.com/security/cve/CVE-2026-34059
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34059
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34059

Red Hat Security Advisory: httpd:2.4 security update

Fixed packages 22

Vulnerabilities 6

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Apache HTTP Server: HTTP/2 DoS by Memory Increase

Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

Apache HTTP Server: mod_authn_socache crash

Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

References