RHSA-2026:99513: Important: httpd:2.4 security update
Important: httpd:2.4 security update
Other sources
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.Security Fix(es): httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) httpd: Apache HTTP Server: Denial of Service in modproxyftp via attacker-controlled FTP server (CVE-2026-44186) httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in modxml2enc (CVE-2026-42536) httpd: Apache HTTP Server: Buffer overflow in modproxyhtml allows security bypass (CVE-2026-34355) httpd: Apache HTTP Server: Out-of-bounds Read in modheaders and modmime (CVE-2026-43951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13 - Upgrade
Upgrade
redhat/httpd-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13 - Upgrade
Upgrade
redhat/httpd-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13 - Upgrade
Upgrade
redhat/httpd-develto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13 - Upgrade
Upgrade
redhat/httpd-filesystemto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13 - Upgrade
Upgrade
redhat/httpd-manualto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13 - Upgrade
Upgrade
redhat/httpd-toolsto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13 - Upgrade
Upgrade
redhat/httpd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+24685+b90b9262.13
Event History
Frequently Asked Questions
Which deployments are most exposed to the proxy-related issues?
Deployments that use Apache HTTP Server to communicate with attacker-controlled or untrusted backend servers are exposed to the heap-based buffer overflow involving malicious backends. Systems using mod_proxy_ftp with attacker-controlled FTP servers, or mod_proxy_html, are also specifically implicated.
Are outbound connections relevant to this update?
Yes. One issue involves a buffer over-read during outbound OCSP requests to an attacker-controlled server. Servers that make OCSP requests to untrusted or attacker-controlled endpoints are therefore relevant to triage.
Which optional Apache modules are named in the reported vulnerabilities?
The listed issues specifically name mod_proxy_ftp, mod_xml2enc, mod_proxy_html, mod_headers, and mod_mime. The update also identifies an issue caused by crafted regular expressions, as well as a NULL pointer dereference triggered by a specially crafted request.
Which Red Hat packages are included in the advisory?
The advisory lists redhat/httpd, redhat/httpd-debuginfo, redhat/httpd-debugsource, redhat/httpd-devel, redhat/httpd-filesystem, and redhat/httpd-manual. It also applies to the listed Red Hat Enterprise Linux Server AUS and x86_64 Extended Life Cycle Long Life offerings.