7165 matches found
CLSA-2026-1792765962 httpd: Fix of CVE-2026-47360
CVE-2026-47360: modsessioncookie: remove the session cookie also when the session was loaded under a different SessionCookieRemove setting - modsessioncookie: as in 2.4.69, with SessionCookieRemove On the session is empty for later loads in the same request, so a SessionMaxAge refresh, a...
RLSA-2026:88229 Important: httpd security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...
httpd security update
An update is available for httpd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...
RockyLinux 9 : httpd (RLSA-2026:88229)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88229 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer...
Oracle Linux 9 : httpd (ELSA-2026-88229)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88229 advisory. - Related: RHEL-275261 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280369 - httpd:...
OESA-2026-4529 busybox security update
The Swiss Army Knife of Embedded Linux Security Fixes: BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.CVE-2026-88831 BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata...
OESA-2026-4528 busybox security update
The Swiss Army Knife of Embedded Linux Security Fixes: BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.CVE-2026-88831 BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata...
OESA-2026-4527 busybox security update
The Swiss Army Knife of Embedded Linux Security Fixes: BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.CVE-2026-88831 BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata...
OESA-2026-4526 busybox security update
The Swiss Army Knife of Embedded Linux Security Fixes: BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.CVE-2026-88831 BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata...
Important: Red Hat Security Advisory: httpd security update
An update for httpd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite
A flaw was found in httpd's modcharsetlite module. A heap-based buffer overflow an out-of-bounds memory write occurs in the finishpartialchar function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory...
httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response
A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...
httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias
A flaw was found in httpd's modvhostalias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause...
httpd: httpd: Authentication state corruption via concurrent Digest authentication requests
A flaw was found in httpd's modauthdigest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce...
httpd: httpd: Denial of Service via integer overflow in mod_dav_fs
A flaw was found in httpd. An integer overflow in the moddavfs module occurs when processing Web Distributed Authoring and Versioning WebDAV PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash...
ALSA-2026:88229 Important: httpd security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...
RHEL 9 : httpd (RHSA-2026:88229)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88229 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP...
SUSE SLED15 / SLES15 Security Update : busybox (SUSE-SU-2026:4760-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4760-1 advisory. - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication hea...
Important: httpd security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...
httpd security update
2.4.62-13.0.1.el98.9 - Replace index.html with Oracle's index page oracleindex.html. 2.4.62-13.9 - Related: RHEL-275261 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280369 - httpd: Denial of Service via modrewrite lookahead...