ALSA-2026:89860: Important: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi (CVE-2026-63718) httpd: httpd: Denial of Service via integer overflow in moddavfs (CVE-2026-93546) httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) httpd: httpd: Arbitrary code execution via oversized Host header in modvhostalias (CVE-2026-63292) httpd: httpd: modheartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) httpd: httpd: Authentication bypass via credential replay in modauthdigest (CVE-2026-73636) httpd: httpd: Denial of Service via charset conversion failure in modxml2enc (CVE-2026-63686) httpd: httpd: Denial of service via forged Authorization headers in modauthdigest (CVE-2026-48005) httpd: httpd: Denial of Service via modrewrite lookahead (CVE-2026-56154) httpd: httpd: Denial of Service via heap-based buffer overflow in modcharsetlite (CVE-2026-56153)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.