RHSA-2026:88229 — Red Hat Security Advisory: httpd security update

Fixed packages 20

Release	Package	Fixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-core	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-core-debuginfo	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-debuginfo	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-debugsource	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-devel	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-filesystem	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-manual	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-tools	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	httpd-tools-debuginfo	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_ldap	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_ldap-debuginfo	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_lua	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_lua-debuginfo	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_proxy_html	1:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_proxy_html-debuginfo	1:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_session	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_session-debuginfo	0:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_ssl	1:2.4.62-13.el9_8.9
Red Hat · RHEL 9 enterprise_linux:9::appstream	mod_ssl-debuginfo	1:2.4.62-13.el9_8.9

Vulnerabilities 11

Critical 9.8

CVE-2026-56154

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 8.8

CVE-2026-93546

Apache HTTP Server: mod_dav_fs namespace overflow

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 8.1

CVE-2026-73636

Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigge…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.5

CVE-2026-46729

Apache HTTP Server: mod_heartmonitor denial of service

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.5

CVE-2026-48005

Apache HTTP Server: mod_auth_digest reauthentication attack

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers w…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.5

CVE-2026-56153

Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.5

CVE-2026-63045

Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.5

CVE-2026-63292 Public exploit

Apache HTTP Server: mod_vhost_alias stack overflow

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.5

CVE-2026-63686 Public exploit

Apache HTTP Server: mod_xml2enc crash on charset conversion failure

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.5

CVE-2026-63718

Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026
High 7.3

CVE-2026-73637

Apache HTTP Server: mod_auth_digest DoS attack

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcC…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Oct 1, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544781
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544798
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544814
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544823
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544832
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544835
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544849
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544852
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544861
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544869
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544885
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88229.json
report
https://access.redhat.com/security/cve/CVE-2026-46729
advisory
https://www.cve.org/CVERecord?id=CVE-2026-46729
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-46729
article
http://www.openwall.com/lists/oss-security/2026/10/01/13
article
https://httpd.apache.org/security/vulnerabilities_24.html
report
https://access.redhat.com/security/cve/CVE-2026-48005
advisory
https://www.cve.org/CVERecord?id=CVE-2026-48005
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-48005
article
http://www.openwall.com/lists/oss-security/2026/10/01/15
report
https://access.redhat.com/security/cve/CVE-2026-56153
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56153
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56153
article
http://www.openwall.com/lists/oss-security/2026/10/01/16
report
https://access.redhat.com/security/cve/CVE-2026-56154
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56154
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56154
article
http://www.openwall.com/lists/oss-security/2026/10/01/17
report
https://access.redhat.com/security/cve/CVE-2026-63045
advisory
https://www.cve.org/CVERecord?id=CVE-2026-63045
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63045
article
http://www.openwall.com/lists/oss-security/2026/10/01/23
report
https://access.redhat.com/security/cve/CVE-2026-63292
advisory
https://www.cve.org/CVERecord?id=CVE-2026-63292
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63292
article
http://www.openwall.com/lists/oss-security/2026/10/01/24
report
https://access.redhat.com/security/cve/CVE-2026-63686

Red Hat Security Advisory: httpd security update

Fixed packages 20

Vulnerabilities 11

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Apache HTTP Server: mod_dav_fs namespace overflow

Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

Apache HTTP Server: mod_heartmonitor denial of service

Apache HTTP Server: mod_auth_digest reauthentication attack

Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

Apache HTTP Server: mod_proxy_ftp PASV address handling

Apache HTTP Server: mod_vhost_alias stack overflow

Apache HTTP Server: mod_xml2enc crash on charset conversion failure

Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Apache HTTP Server: mod_auth_digest DoS attack

References