Red Hat Security Advisory: httpd:2.4 security update

Fixed packages 44

Vulnerabilities 7

• Critical 9.8
  CVE-2026-28780

  Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

  Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  May 5, 2026
• High 7.5
  CVE-2025-53020 Public exploit

  Apache HTTP Server: HTTP/2 DoS by Memory Increase

  Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2026-34059

  Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

  Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.5
  CVE-2026-49975 Public exploit EPSS 33%

  Apache HTTP Server: mod_http2 denial of service

  Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Medium 5.3
  CVE-2026-33007

  Apache HTTP Server: mod_authn_socache crash

  A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fix…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-33857

  Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

  Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 5.3
  CVE-2026-34032

  Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

  Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379343
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464940
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464952
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464953
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465299
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2466913
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485371
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36831.json
• report
  https://access.redhat.com/security/cve/CVE-2025-53020
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-53020
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-53020
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2026-28780
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28780
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28780
• report
  https://access.redhat.com/security/cve/CVE-2026-33007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33007
• report
  https://access.redhat.com/security/cve/CVE-2026-33857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33857
• report
  https://access.redhat.com/security/cve/CVE-2026-34032
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34032
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34032
• report
  https://access.redhat.com/security/cve/CVE-2026-34059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34059
• report
  https://access.redhat.com/security/cve/CVE-2026-49975
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49975
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49975
• article
  https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb