RHSA-2026:98130: Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.Security Fix(es): httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) httpd: Apache HTTP Server: Denial of Service in modproxyftp via attacker-controlled FTP server (CVE-2026-44186) httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in modxml2enc (CVE-2026-42536) httpd: Apache HTTP Server: Buffer overflow in modproxyhtml allows security bypass (CVE-2026-34355) httpd: Apache HTTP Server: Out-of-bounds Read in modheaders and modmime (CVE-2026-43951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13 - Upgrade
Upgrade
redhat/httpd-filesystemto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13 - Upgrade
Upgrade
redhat/httpd-manualto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13 - Upgrade
Upgrade
redhat/httpd-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13 - Upgrade
Upgrade
redhat/httpd-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13 - Upgrade
Upgrade
redhat/httpd-develto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13 - Upgrade
Upgrade
redhat/httpd-toolsto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13 - Upgrade
Upgrade
redhat/httpd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-56.module+el8.8.0+24683+908cede0.13
Event History
Frequently Asked Questions
Which Apache HTTP Server deployments are potentially exposed to the issues in this update?
Deployments using the listed Red Hat httpd packages are potentially affected. Exposure to individual issues depends on whether relevant features are in use, including proxying to backend or FTP servers, outbound OCSP requests, mod_xml2enc, mod_proxy_html, mod_headers, or mod_mime.
What attacker-controlled inputs or systems are involved in these vulnerabilities?
The advisory identifies specially crafted HTTP requests, crafted regular expressions, untrusted content, and malicious or attacker-controlled backend, FTP, and OCSP servers as attack vectors. Some issues therefore may require the server to interact with an untrusted upstream service rather than only receive client requests.
Are availability-only impacts included in this update?
Yes. The update addresses denial-of-service issues involving crafted regular expressions and mod_proxy_ftp interactions with attacker-controlled FTP servers. It also includes a NULL pointer dereference triggered by a specially crafted request.
How can I determine whether the affected software is installed?
Check whether any of the listed Red Hat packages are installed, including httpd, httpd-tools, httpd-devel, httpd-filesystem, httpd-manual, or their debug packages. The advisory does not provide fixed package versions or configuration-specific detection steps.