RLSA-2026:92616: Important: httpd:2.4 security, bug fix, and enhancement update

Q: Which deployments should be prioritized for remediation?

Prioritize Rocky Linux systems running httpd, especially where mod_auth_digest, mod_proxy_uwsgi, mod_dav_fs, mod_vhost_alias, mod_heartmonitor, mod_xml2enc, or mod_rewrite are enabled or used. The listed issues include authentication bypass, response smuggling, denial of service, arbitrary host connections, and arbitrary code execution.

Q: Can these issues be exploited remotely without an authenticated account?

The advisory’s severity vector indicates network attack access, no required privileges, and no user interaction. It also rates confidentiality, integrity, and availability impact as high, although the listed flaws affect different httpd modules and features.

Q: Which Rocky Linux packages are included in this update?

The advisory identifies rocky-linux/httpd, rocky-linux/mod_http2, and rocky-linux/mod_md. It does not provide affected or fixed package version numbers in the supplied data.

Published Oct 30, 2026

Updated

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: modauthdigest: timing attack allows a bypass of digest authentication (CVE-2026-33006)

httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi (CVE-2026-63718)

httpd: httpd: Denial of Service via integer overflow in moddavfs (CVE-2026-93546)

httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637)

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)

httpd: httpd: Arbitrary code execution via oversized Host header in modvhostalias (CVE-2026-63292)

httpd: httpd: modheartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729)

httpd: httpd: Authentication bypass via credential replay in modauthdigest (CVE-2026-73636)

httpd: httpd: Denial of Service via charset conversion failure in modxml2enc (CVE-2026-63686)

httpd: httpd: Denial of service via forged Authorization headers in modauthdigest (CVE-2026-48005)

httpd: httpd: Denial of Service via modrewrite lookahead (CVE-2026-56154)

httpd: httpd: Denial of Service via heap-based buffer overflow in modcharsetlite (CVE-2026-56153)

Bug Fix(es) and Enhancement(s):

modproxyhcheck: passing health check does not recover worker from its standard error state (PROXYWORKERINERROR) (JIRA:Rocky Linux-256797)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

24 affected componentsFixes available

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+40197+0231e209.8

0:2.4.37-65.module+el8.10.0+40197+0231e209.8

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2

0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3

0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+40206+be2c8a50.8

0:2.4.37-65.module+el8.10.0+40206+be2c8a50.8

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+40257+286895ef.9

0:2.4.37-65.module+el8.10.0+40257+286895ef.9

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+1984+1bed3124.4

0:2.4.37-65.module+el8.10.0+1984+1bed3124.4

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+40312+2c72bb9b.10

0:2.4.37-65.module+el8.10.0+40312+2c72bb9b.10

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5

0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+40402+af9563a3.13

0:2.4.37-65.module+el8.10.0+40402+af9563a3.13

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6

0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+1830+22f0c9e0

0:2.4.37-65.module+el8.10.0+1830+22f0c9e0

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+40053+5a18018e.7

0:2.4.37-65.module+el8.10.0+40053+5a18018e.7

rocky-linux/httpd<0:2.4.37-65.module+el8.10.0+1840+b070a976.1

0:2.4.37-65.module+el8.10.0+1840+b070a976.1

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+1775+6b057638

0:1.15.7-10.module+el8.10.0+1775+6b057638

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+1830+22f0c9e0

0:1.15.7-10.module+el8.10.0+1830+22f0c9e0

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1

0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3

0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4

0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+40197+0231e209.5

0:1.15.7-10.module+el8.10.0+40197+0231e209.5

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+40204+716978aa.6

0:1.15.7-10.module+el8.10.0+40204+716978aa.6

rocky-linux/mod_http2<0:1.15.7-10.module+el8.10.0+40257+286895ef.7

0:1.15.7-10.module+el8.10.0+40257+286895ef.7

rocky-linux/mod_md<1:2.0.8-8.module+el8.10.0+40053+5a18018e.2

1:2.0.8-8.module+el8.10.0+40053+5a18018e.2

rocky-linux/mod_md<1:2.0.8-8.module+el8.10.0+40369+03c444c1.4

1:2.0.8-8.module+el8.10.0+40369+03c444c1.4

rocky-linux/mod_md<1:2.0.8-8.module+el8.9.0+1370+89cc8ad5

1:2.0.8-8.module+el8.9.0+1370+89cc8ad5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+40197+0231e209.8
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+40206+be2c8a50.8
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+40257+286895ef.9
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+40312+2c72bb9b.10
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+40402+af9563a3.13
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+40053+5a18018e.7
Upgrade
Upgrade rocky-linux/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-65.module+el8.10.0+1840+b070a976.1
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+1775+6b057638
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+40197+0231e209.5
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+40204+716978aa.6
Upgrade
Upgrade rocky-linux/mod_http2 to a version that resolves this vulnerability.
Fixed in 0:1.15.7-10.module+el8.10.0+40257+286895ef.7
Upgrade
Upgrade rocky-linux/mod_md to a version that resolves this vulnerability.
Fixed in 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2
Upgrade
Upgrade rocky-linux/mod_md to a version that resolves this vulnerability.
Fixed in 1:2.0.8-8.module+el8.10.0+40369+03c444c1.4
Upgrade
Upgrade rocky-linux/mod_md to a version that resolves this vulnerability.
Fixed in 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5

Event History

Oct 30, 2026

Advisory Published

via OSV·12:01 PM

Data Sourced

via OSV·12:01 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Prioritize Rocky Linux systems running httpd, especially where mod_auth_digest, mod_proxy_uwsgi, mod_dav_fs, mod_vhost_alias, mod_heartmonitor, mod_xml2enc, or mod_rewrite are enabled or used. The listed issues include authentication bypass, response smuggling, denial of service, arbitrary host connections, and arbitrary code execution.

Can these issues be exploited remotely without an authenticated account?

The advisory’s severity vector indicates network attack access, no required privileges, and no user interaction. It also rates confidentiality, integrity, and availability impact as high, although the listed flaws affect different httpd modules and features.

Which Rocky Linux packages are included in this update?

The advisory identifies rocky-linux/httpd, rocky-linux/mod_http2, and rocky-linux/mod_md. It does not provide affected or fixed package version numbers in the supplied data.

RLSA-2026:92616: Important: httpd:2.4 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Can these issues be exploited remotely without an authenticated account?

Which Rocky Linux packages are included in this update?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Can these issues be exploited remotely without an authenticated account?

Which Rocky Linux packages are included in this update?