Important: httpd:2.4 security update

🗓️ 01 Jun 2026 00:00:00Reported by AlmaLinuxType

almalinux🔗 errata.almalinux.org👁 29 Views

Httpd 2.4 update fixes several CVEs for memory denial of service, buffer overreads, null dereference, and arbitrary code execution.

Reporter	Title	Published	Views	Family All 565
GithubExploit	Exploit for Missing Release of Memory after Effective Lifetime in Apache Http_Server	12 Jan 202608:14	–	githubexploit
FreeBSD	www/apache24 -- Multiple vulnerabilities	4 May 202600:00	–	freebsd
FreeBSD	Apache httpd -- Multiple vulnerabilities	10 Jul 202500:00	–	freebsd
FreeBSD	mod_http2 -- Multiple vulnerabilities	10 Jul 202500:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase [CVE-2026-24072, CVE-2026-28780, CVE-2026-34059, CVE-2026-33523, CVE-2026-41080, CVE-2026-33857, CVE-2026-34032]	22 May 202605:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities	11 May 202622:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server	18 May 202615:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.	3 Nov 202509:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.	8 Jun 202616:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnarabilities in kernel, glibc, expat, RMC daemon, httpd and mod_http2 libraries (CVE-2026-46333, CVE-2026-4046, CVE-2026-45186, CVE-2026-14514, CVE-2025-53020, CVE-2026-49975) affect Power HMC.	22 Sep 202607:04	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
almalinux	8	noarch	httpd-filesystem	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	httpd-filesystem-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.noarch.rpm
almalinux	8	noarch	httpd-manual	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	httpd-manual-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.noarch.rpm
almalinux	8	x86_64	mod_md	2.0.8-8.module_el8.10.0+4088+57f011c1.2	mod_md-2.0.8-8.module_el8.10.0+4088+57f011c1.2.x86_64.rpm
almalinux	8	x86_64	mod_session	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	mod_session-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.x86_64.rpm
almalinux	8	x86_64	mod_proxy_html	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	mod_proxy_html-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.x86_64.rpm
almalinux	8	x86_64	mod_ldap	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	mod_ldap-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.x86_64.rpm
almalinux	8	x86_64	httpd	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	httpd-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.x86_64.rpm
almalinux	8	x86_64	mod_http2	1.15.7-10.module_el8.10.0+4185+0955a0d7.5	mod_http2-1.15.7-10.module_el8.10.0+4185+0955a0d7.5.x86_64.rpm
almalinux	8	x86_64	httpd-devel	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	httpd-devel-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.x86_64.rpm
almalinux	8	x86_64	httpd-tools	2.4.37-65.module_el8.10.0+4185+0955a0d7.8	httpd-tools-2.4.37-65.module_el8.10.0+4185+0955a0d7.8.x86_64.rpm

Source	Link
access	www.access.redhat.com/errata/RHSA-2026:22140
access	www.access.redhat.com/security/cve/CVE-2025-53020
access	www.access.redhat.com/security/cve/CVE-2026-28780
access	www.access.redhat.com/security/cve/CVE-2026-33007
access	www.access.redhat.com/security/cve/CVE-2026-33857
access	www.access.redhat.com/security/cve/CVE-2026-34032
access	www.access.redhat.com/security/cve/CVE-2026-34059
bugzilla	www.bugzilla.redhat.com/2379343
bugzilla	www.bugzilla.redhat.com/2464940
bugzilla	www.bugzilla.redhat.com/2464952

03 Jun 2026 07:59Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.5

EPSS0.04799

SSVC