Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
* httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)
* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)
* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)
* httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)
Bug Fix(es) and Enhancement(s):
* mod_proxy_html regression in CVE-2026-34355 fix [rhel-8.10.z] (JIRA:Rocky Linux-192751)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40206+be2c8a50.8 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40053+5a18018e.7 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1840+b070a976.1 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40197+0231e209.8 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+40204+716978aa.6 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1775+6b057638 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+40197+0231e209.5 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4 |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2 |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 |
Vulnerabilities 9
-
Critical 9.8
Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.5
Apache HTTP Server: HTTP response splitting
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 b…
-
High 7.5
Apache HTTP Server: mod_dav_lock indirect lock crash
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was m…
-
High 7.5
Apache HTTP Server: mod_proxy_html buffer overflow
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
-
High 7.5
Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the iss…
-
High 7.5CVE-2026-42536 Public exploit
Apache HTTP Server: mod_xml2enc heap overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.3
Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to…
-
Medium 6.5
Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2374549
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2465296
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486395
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486397
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486399
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486402
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486411
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486414
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486415