RHSA-2026:99514: Important: httpd:2.4 security update
Important: httpd:2.4 security update
Other sources
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.Security Fix(es): httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) httpd: Apache HTTP Server: Denial of Service in modproxyftp via attacker-controlled FTP server (CVE-2026-44186) httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in modxml2enc (CVE-2026-42536) httpd: Apache HTTP Server: Buffer overflow in modproxyhtml allows security bypass (CVE-2026-34355) httpd: Apache HTTP Server: Out-of-bounds Read in modheaders and modmime (CVE-2026-43951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 - Upgrade
Upgrade
redhat/httpd-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 - Upgrade
Upgrade
redhat/httpd-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 - Upgrade
Upgrade
redhat/httpd-develto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 - Upgrade
Upgrade
redhat/httpd-filesystemto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 - Upgrade
Upgrade
redhat/httpd-manualto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 - Upgrade
Upgrade
redhat/httpd-toolsto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 - Upgrade
Upgrade
redhat/httpd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
Event History
Frequently Asked Questions
Which Apache HTTP Server components and deployment roles are implicated by the listed fixes?
The advisory identifies issues involving mod_proxy_ftp, mod_proxy_html, mod_xml2enc, mod_headers, and mod_mime. It also lists flaws involving outbound OCSP requests and backend servers, so deployments using those functions are specifically relevant.
What attacker-controlled inputs or systems are involved in the reported issues?
The listed attack paths include specially crafted HTTP requests, crafted regular expressions, malicious backend servers, attacker-controlled OCSP servers, attacker-controlled FTP servers, and untrusted content processed by mod_xml2enc. The advisory also identifies a buffer overflow in mod_proxy_html that can permit a security bypass.
What types of impact are addressed by this update?
The fixes include heap-based buffer overflows, a buffer overflow, a buffer over-read, an out-of-bounds read, a NULL pointer dereference, and denial-of-service conditions. One listed issue is an incomplete fix for CVE-2023-38709.