Skip to content
OpenAdvisories
High RLSA-2024:5138 1 CVE

Important: httpd security update

Published Aug 21, 2024 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Security issues via?backend applications whose response headers are malicious or exploitable (CVE-2024-38476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 httpd 0:2.4.57-11.el9_4.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2024-38476 Public exploit EPSS 42%

    Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2295015