CVE-2026-47360: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

PT-2026-103924

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description A NULL pointer dereference exists in the mod heartmonitor module when used over a unicast listener. This issue can lead to a Denial of Service DoS, which is a condition where the...

PT-2026-103926

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description Missing authentication checks in the mod auth digest module allow an unauthenticated remote client to trigger a denial of service, specifically forced re-authentication. This occurs when...

CVE-2026-47360: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

PT-2026-103922

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.60 through 2.4.68 Description A deployment of wrong handler issue allows the target of certain internal redirects from CGI programs to be treated as CGI and executed. This occurs if the target is located in a...

CVE-2026-48005: Missing Authentication for Critical Function

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

CVE-2026-42356: Deployment of Wrong Handler

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

PT-2026-103925

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description The mod session cookie module contains an issue where sensitive information may be exposed to an unauthorized actor. Specifically, when the SessionCookieRemove directive changes duri...

PT-2026-105155

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

PT-2026-103937

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.30 through 2.4.68 Description An issue exists involving the inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling. This occurs via the mod proxy uwsgi module when processing a...

PT-2026-103936

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description A NULL pointer dereference occurs in the mod xml2enc module. This allows an untrusted backend server to trigger a denial of service by sending a proxied response with a charset that...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc (crlsa-2023_1673)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20231673 advisory. httpd: HTTP request splitting with modrewrite and modproxy CVE-2023-25690 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782224876)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782224876 advisory. - Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776854729)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776854729 advisory. - A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-complian...

KLA91312 Multiple vulnerabilities in Apache HTTP Server

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability can b...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783520633)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783520633 advisory. - Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37,...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1782317575)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1782317575 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

Rocky Linux 9 [CIQ] Security Update: mod_http2 / mod_http2-debuginfo / mod_http2-debugsource (crlsa-2024_8680)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20248680 advisory. modhttp2: DoS by null pointer in websocket over HTTP/2 CVE-2024-36387 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 9 [CIQ] Security Update: varnish / varnish-devel / varnish-docs (crlsa-2024_1691)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241691 advisory. varnish: HTTP/2 Broken Window Attack may result in denial of service CVE-2024-30156 Tenable has extracted the preceding description block directly from the CIQ...