Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd-debuginfo | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd-debugsource | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd-devel | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd-filesystem | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd-manual | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd-tools | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpd-tools-debuginfo | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_http2 | 0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_http2-debuginfo | 0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_http2-debugsource | 0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_ldap | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_ldap-debuginfo | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_md | 1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_md-debuginfo | 1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_md-debugsource | 1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_proxy_html | 1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_proxy_html-debuginfo | 1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_session | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_session-debuginfo | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_ssl | 1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | mod_ssl-debuginfo | 1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
Vulnerabilities 9
-
Critical 9.8
Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.5
Apache HTTP Server: HTTP response splitting
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 b…
-
High 7.5
Apache HTTP Server: mod_dav_lock indirect lock crash
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was m…
-
High 7.5
Apache HTTP Server: mod_proxy_html buffer overflow
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
-
High 7.5
Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the iss…
-
High 7.5CVE-2026-42536 Public exploit
Apache HTTP Server: mod_xml2enc heap overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3
Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to…
-
Medium 6.5
Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2374549
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2465296
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486395
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486397
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486399
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486402
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486411
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486414
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486415
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42828.json
-
report
https://access.redhat.com/security/cve/CVE-2024-42516
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-42516
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-42516
-
article
https://httpd.apache.org/security/vulnerabilities_24.html
-
report
https://access.redhat.com/security/cve/CVE-2026-29169
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-29169
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-29169
-
report
https://access.redhat.com/security/cve/CVE-2026-34355
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34355
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34355
-
report
https://access.redhat.com/security/cve/CVE-2026-34356
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34356
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34356
-
report
https://access.redhat.com/security/cve/CVE-2026-42536
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-42536
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42536
-
report
https://access.redhat.com/security/cve/CVE-2026-43951
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-43951
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-43951
-
report
https://access.redhat.com/security/cve/CVE-2026-44185
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-44185
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44185
-
report
https://access.redhat.com/security/cve/CVE-2026-44186
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-44186
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44186
-
report
https://access.redhat.com/security/cve/CVE-2026-44631
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-44631
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44631