USN-8589-1: Apache HTTP Server vulnerabilities

It was discovered that Apache HTTP Server's modldap module incorrectly handled memory when processing per-directory configurations. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-29167 It was discovered that Apache HTTP Server's...

Vulnerabilities found in Oracle Communications

Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...

TencentOS Server 3: httpd:2.4 (TSSA-2026:0732)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0732 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

Important: Red Hat Security Advisory: httpd:2.4 security, bug fix, and enhancement update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...

httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service...

ALSA-2026:42828 Important: httpd:2.4 security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 httpd: NULL pointer dereference via specially crafted request CVE-2026-29169 httpd: Apache HTTP Server: Heap-based Buffer...

RHEL 8 : httpd:2.4 (RHSA-2026:42828)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42828 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

USN-8571-1: Apache HTTP Server vulnerabilities

Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in modauthnsocache. A remote attacker could possibly use this issue to cause a denial of service. CVE-2026-33007 Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apach...

httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol OCSP requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or...

Important: Red Hat Security Advisory: httpd security, bug fix, and enhancement update

An update for httpd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Oracle Linux 9 : httpd (ELSA-2026-41906)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41906 advisory. - Resolves: RHEL-192752 - modproxyhtml regression in CVE-2026-34355 fix - Resolves: RHEL-186217 - httpd: Apache HTTP Server: Heap-based Buffer Overflo...

httpd security, bug fix, and enhancement update

2.4.62-13.0.1.el98.5 - Replace index.html with Oracle's index page oracleindex.html. 2.4.62-13.5 - Resolves: RHEL-192752 - modproxyhtml regression in CVE-2026-34355 fix 2.4.62-13.4 - Resolves: RHEL-186217 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers...

K000162320: Apache HTTP server vulnerability CVE-2026-44119

Security Advisory Description Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgrade to...

mod_md security update

1:2.4.26-5.1 - Resolves: RHEL-175647 - modmd: OCSP response limits CVE-2026-29168 1:2.4.26-5 - Resolves: RHEL-134484 - httpd: Apache HTTP Server: modmd ACME, unintended retry intervals CVE-2025-55753 1:2.4.26-3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 1:2.4.26-2 - Bump...

MiracleLinux 9 : httpd-2.4.62-13.el9_8.1 (AXSA:2026-1272:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1272:07 advisory. httpd: modproxyajp: heap-based buffer over-read and memory disclosure in ajpparsedata CVE-2026-34059 httpd: modproxyajp: heap-based buffer over-read...