ALSA-2026:92616: Important: httpd:2.4 security, bug fix, and enhancement update

Q: Which Apache deployments are most exposed?

Exposure depends on which optional modules and features are enabled. The listed issues affect mod_auth_digest, mod_proxy_uwsgi, mod_dav_fs, mod_vhost_alias, mod_heartmonitor, mod_xml2enc, mod_rewrite, and FTP proxy handling; systems using those components should be prioritized.

Q: What attacker access is indicated by the advisory?

Several issues can be triggered through crafted HTTP inputs, including Host, Authorization, and Transfer-Encoding headers. The FTP PASV issue involves a crafted FTP server response, while the Digest authentication issues concern requests to services using Digest authentication.

Q: Are all installed httpd packages necessarily affected in their default configuration?

The advisory does not state that every default configuration is vulnerable. Multiple fixes are tied to specific modules, so impact depends on whether the relevant module and functionality are installed and enabled.

Q: How can I assess whether a server may be affected before updating?

Review the active Apache configuration for use of the modules and features named in the advisory, particularly Digest authentication, proxying to uWSGI or FTP, DAV filesystem support, vhost aliases, heartmonitor, XML encoding, and rewrite lookaheads. Also identify whether the installed AlmaLinux httpd-related packages are among the packages covered by the update.

Published Oct 29, 2026

Updated

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: modauthdigest: timing attack allows a bypass of digest authentication (CVE-2026-33006) httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi (CVE-2026-63718) httpd: httpd: Denial of Service via integer overflow in moddavfs (CVE-2026-93546) httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) httpd: httpd: Arbitrary code execution via oversized Host header in modvhostalias (CVE-2026-63292) httpd: httpd: modheartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) httpd: httpd: Authentication bypass via credential replay in modauthdigest (CVE-2026-73636) httpd: httpd: Denial of Service via charset conversion failure in modxml2enc (CVE-2026-63686) httpd: httpd: Denial of service via forged Authorization headers in modauthdigest (CVE-2026-48005) httpd: httpd: Denial of Service via modrewrite lookahead (CVE-2026-56154) httpd: httpd: Denial of Service via heap-based buffer overflow in modcharsetlite (CVE-2026-56153)

Bug Fix(es) and Enhancement(s):

modproxyhcheck: passing health check does not recover worker from its standard error state (PROXYWORKERINERROR) (JIRA:RHEL-256797)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.