Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)
* httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718)
* httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546)
* httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637)
* httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)
* httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292)
* httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729)
* httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636)
* httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686)
* httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005)
* httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154)
* httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153)
Bug Fix(es) and Enhancement(s):
* mod_proxy_hcheck: passing health check does not recover worker from its standard error state (PROXY_WORKER_IN_ERROR) (JIRA:Rocky Linux-256797)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 24
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40197+0231e209.8 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40206+be2c8a50.8 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40257+286895ef.9 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40312+2c72bb9b.10 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40402+af9563a3.13 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+40053+5a18018e.7 |
| Rocky Linux · 8 | httpd | 0:2.4.37-65.module+el8.10.0+1840+b070a976.1 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1775+6b057638 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+40197+0231e209.5 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+40204+716978aa.6 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+40257+286895ef.7 |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2 |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.10.0+40369+03c444c1.4 |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 |
Vulnerabilities 12
-
Critical 9.8
Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 8.8
Apache HTTP Server: mod_dav_fs namespace overflow
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
-
High 8.1
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigge…
-
High 7.5
Apache HTTP Server: mod_heartmonitor denial of service
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_auth_digest reauthentication attack
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers w…
-
High 7.5
Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 7.5
Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an…
-
High 7.5CVE-2026-63292 Public exploit
Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…
-
High 7.5CVE-2026-63686 Public exploit
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30…
-
High 7.3
Apache HTTP Server: mod_auth_digest DoS attack
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcC…
-
Medium 4.8CVE-2026-33006 Public exploit
Apache HTTP Server: mod_auth_digest timing attack
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2465293
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544781
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544798
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544814
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544823
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544832
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544835
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544849
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544852
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544861
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544869
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2544885
-
advisory
https://access.redhat.com/errata/RHSA-2026:92616