Exploit for CVE-2026-118238

Tenda W18E - Unauthenticated Root Command Injection diagnose...

RLSA-2026:89860 Important: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...

httpd security update

An update is available for httpd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

RockyLinux 10 : httpd (RLSA-2026:89860)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89860 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via intege...

httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite

A flaw was found in httpd's modcharsetlite module. A heap-based buffer overflow an out-of-bounds memory write occurs in the finishpartialchar function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

Important: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

httpd: httpd: Denial of Service via integer overflow in mod_dav_fs

A flaw was found in httpd. An integer overflow in the moddavfs module occurs when processing Web Distributed Authoring and Versioning WebDAV PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash...

httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias

A flaw was found in httpd's modvhostalias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause...

httpd: httpd: Authentication state corruption via concurrent Digest authentication requests

A flaw was found in httpd's modauthdigest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce...

RHEL 10 : httpd (RHSA-2026:89860)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89860 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP...

ALSA-2026:89860 Important: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...

httpd security update

2.4.63-13.0.1.el102.8 - Replace index.html with Oracle's index page oracleindex.html. 2.4.63-13.8 - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280355 - httpd: Denial of Service via modrewrite lookahead...

Oracle Linux 10 : httpd (ELSA-2026-89860)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89860 advisory. - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280355 - httpd:...

MiracleLinux 9 : httpd-2.4.62-13.el9_8.9 (AXSA:2026-2145:11)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2145:11 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88229)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688229 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer...

CLSA-2026-1792765962 httpd: Fix of CVE-2026-47360

CVE-2026-47360: modsessioncookie: remove the session cookie also when the session was loaded under a different SessionCookieRemove setting - modsessioncookie: as in 2.4.69, with SessionCookieRemove On the session is empty for later loads in the same request, so a SessionMaxAge refresh, a...

httpd security update

An update is available for httpd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

RLSA-2026:88229 Important: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...

Oracle Linux 9 : httpd (ELSA-2026-88229)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88229 advisory. - Related: RHEL-275261 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280369 - httpd:...