Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update

Fixed packages 39

Vulnerabilities 10

• Critical 9.8
  CVE-2026-28780

  Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

  Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  May 5, 2026
• High 7.5
  CVE-2025-53020 Public exploit

  Apache HTTP Server: HTTP/2 DoS by Memory Increase

  Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2026-27135

  nghttp2 Denial of service: Assertion failure due to the missing state validation

  nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2…

  nghttp2 nghttp2 nodejs cmake Debian Ubuntu Azure Linux Alpine
  Mar 18, 2026
• High 7.5
  CVE-2026-29169

  Apache HTTP Server: mod_dav_lock indirect lock crash

  A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was m…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.5
  CVE-2026-34059

  Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

  Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.5
  CVE-2026-49975 Public exploit EPSS 33%

  Apache HTTP Server: mod_http2 denial of service

  Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.3
  CVE-2026-29168

  Apache HTTP Server: mod_md unrestricted OCSP response

  Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the i…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 5, 2026
• Medium 5.3
  CVE-2026-33007

  Apache HTTP Server: mod_authn_socache crash

  A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-33857

  Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

  Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-34032

  Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

  Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379343
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448754
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464940
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464952
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464953
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465296
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465299
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2466753
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2466913
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485371
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27200.json
• report
  https://access.redhat.com/security/cve/CVE-2025-53020
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-53020
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-53020
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2026-27135
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27135
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27135
• article
  https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1
• article
  https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6
• report
  https://access.redhat.com/security/cve/CVE-2026-28780
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28780
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28780
• report
  https://access.redhat.com/security/cve/CVE-2026-29168
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-29168
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-29168
• report
  https://access.redhat.com/security/cve/CVE-2026-29169
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-29169
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-29169
• report
  https://access.redhat.com/security/cve/CVE-2026-33007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33007
• report
  https://access.redhat.com/security/cve/CVE-2026-33857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33857
• report
  https://access.redhat.com/security/cve/CVE-2026-34032
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34032