Apache HTTPD: Multiple Vulnerabilities

Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: httpd: httpd-2.4.68-6.hum1 aarch64, x8664 httpd-core-2.4.68-6.hum1 aarch64, x8664 httpd-devel-2.4.68-6.hum1 aarch64, x8664 httpd-filesystem-2.4.68-6.hum1 noarch httpd-manual-2.4.68-6.hum1 noarch...

httpd: mod_md: unrestricted OCSP response leads to resource exhaustion

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

HiSilicon uc-httpd - Path Traversal Detection

Detects HiSilicon ASIC firmware path traversal by requesting ../../etc/passwd on uc-httpd servers. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon uc-httpd path traversal file read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

RHEL 9 : mod_http2 (RHSA-2026:50572)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:50572 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...

Photon OS 5.0: Httpd PHSA-2025-5.0-91-0710

An update of the httpd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0710. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Httpd PHSA-2026-5.0-91-0848

An update of the httpd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0848. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Apache PHSA-2023-5.0-91-0030

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0030. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Apache PHSA-2025-5.0-91-0537

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0537. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 10 : mod_md (RHSA-2026:52393)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52393 advisory. This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate...

Photon OS 5.0: Httpd PHSA-2024-5.0-91-0314

An update of the httpd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0314. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-9031 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web...

CVE-2026-9030 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

CVE-2026-9030

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

PT-2026-69144

Name of the Vulnerable Software and Affected Versions Archer A6 v4 Description A denial-of-service issue exists in the httpd service. The asynchronous systool instruction handling path fails to properly synchronize or safely manage concurrent systool operations. An authenticated attacker can send...

CVE-2026-9030: Concurrent Execution using Shared Resource with Improper Synchronization

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

CLSA-2026-1783698569 httpd: Fix of 6 CVEs

CVE-2026-44186: modproxyftp: fix infinite loop parsing the Retry-After delay in an FTP response - advance the scan pointer so the whitespace-prefixed digit search terminates...

httpd: Fix of CVE-2026-44186

CVE-2026-44186: modproxyftp: infinite loop in proxyftphandler when scanning an FTP 120 greeting for a Retry-After delta-seconds value; the scan loop never advanced secsstr, so it spun forever on any greeting that did not begin with a digit, letting a backend FTP server hang worker processes...

CLSA-2026-1786004455 httpd: Fix of CVE-2026-44186

CVE-2026-44186: modproxyftp: infinite loop in proxyftphandler when scanning an FTP 120 greeting for a Retry-After delta-seconds value; the scan loop never advanced secsstr, so it spun forever on any greeting that did not begin with a digit, letting a backend FTP server hang worker processes...