Rocky Linux 9.4 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0536)

The Rocky Linux 9.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260536 advisory. This advisory aggregates security fixes for the httpd SRPM in CIQ LTS 9.4. It addresses 3 CVEs: CVE-2025-23048, CVE-2025-49812, CVE-2024-47252. Tenable h...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2024_3121)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243121 advisory. httpd: modmacro: out-of-bounds read vulnerability CVE-2023-31122 modhttp2: reset requests exhaust memory incomplete fix of CVE-2023-44487 CVE-2023-45802...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1758914381)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2025:1758914381 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1758915354)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1758915354 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1769014292)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1769014292 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2023:1698949696)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2023:1698949696 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1777033551)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777033551 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1769013944)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1769013944 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables se...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1723059198)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1723059198 advisory. - A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1758914697)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1758914697 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1757501175)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1757501175 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

AlmaLinux 9.2 [TuxCare] Security Update: mod_auth_openidc (ALMALINUX9.2:CLSA-2025:1752247075)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752247075 advisory. - A flaw was found in the modauthopenidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2023:1695752598)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1695752598 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

httpd: mod_auth_digest: timing attack allows a bypass of digest authentication

A flaw was found in the modauthdigest module of httpd. A remote unauthenticated attacker can bypass digest authentication by measuring timing discrepancies of requests. This issue leads to unauthorized access to resources protected by digest authentication...

httpd: HTTP response splitting forwarding malicious status line

A flaw was found in httpd. When processing responses from an untrusted or compromised backend server, multiple modules fail to sanitize Carriage Return and Line Feed CRLF sequences in the HTTP status line. This issue leads to an HTTP response splitting attack...

httpd: HTTP response splitting forwarding malicious status line

A flaw was found in httpd. When processing responses from an untrusted or compromised backend server, multiple modules fail to sanitize Carriage Return and Line Feed CRLF sequences in the HTTP status line. This issue leads to an HTTP response splitting attack...

httpd: mod_auth_digest: timing attack allows a bypass of digest authentication

A flaw was found in the modauthdigest module of httpd. A remote unauthenticated attacker can bypass digest authentication by measuring timing discrepancies of requests. This issue leads to unauthorized access to resources protected by digest authentication...

busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...