Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 security update

Fixed packages 26

Vulnerabilities 2

• Medium 6.5
  CVE-2026-33523

  Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

  HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• Medium 4.8
  CVE-2026-33006 Public exploit

  Apache HTTP Server: mod_auth_digest timing attack

  A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_6_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2465297
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73076.json
• report
  https://access.redhat.com/security/cve/CVE-2026-33006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33006
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33006
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2026-33523
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33523
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33523