RHSA-2026:57641: Moderate: mod_md security update
Moderate: modmd security update
Other sources
This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.Security Fix(es): httpd: modmd: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
httpd (mod_md)to a version that resolves this vulnerability.Patch CVE-2026-29168
Event History
Frequently Asked Questions
Which deployments are most relevant to this update?
Deployments using mod_md to manage domains and virtual hosts are relevant, particularly where it automates certificate provisioning or renewal through ACME. The issue is described as resource exhaustion caused by an unrestricted OCSP response.
Does the advisory specify what an attacker must be able to do to exploit the issue?
No. It identifies the affected component and the resource-exhaustion condition, but does not state the required attacker access, authentication status, or delivery method for the OCSP response.
Which Red Hat platforms are listed for this advisory?
The listed products cover Red Hat Enterprise Linux for IBM z Systems, Power little endian, ARM 64, and x86_64 under various Extended Life Cycle, Extended Update Support, SAP Update Services, and four-years-of-updates offerings. The supplied advisory data does not include specific affected package versions.