RHEL 7 : httpd (RHSA-2026:92590)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92590 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

Important: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

OESA-2026-4466 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of...

OESA-2026-4465 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.CVE-2026-56153 Use After Free vulnerability in Apache HTTP Server...

OESA-2026-4464 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791889844)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791889844 advisory. - A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791889844)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791889844 advisory. - A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks ...

Astra Linux – vulnerability in Apache2

The Loop with Unreachable Exit Condition ‘Infinite Loop’ vulnerability exists in the modproxyftp module of the Apache HTTP Server when an attacker controls a backend FTP server. This issue affects versions 2.4.0 through 2.4.67. Users are advised to upgrade to version 2.4.68, which resolves the...

Updated apache package fixes security vulnerabilities

Limited RCE for some internal redirects to non-CGI files in CGI directories. CVE-2026-42356 moddav shared lock overflow. CVE-2026-42528 modheartmonitor denial of service. CVE-2026-46729 modsession: Session cookie not removed during internal redirect. CVE-2026-47360 modauthdigest reauthentication...

CLSA-2026-1791889844 httpd: Fix of 11 CVEs

CVE-2026-63718: modproxyuwsgi: drop hop-by-hop headers from the backend response - CVE-2026-73636: modauthdigest: accept a one-time nonce only once, also when the client entry was garbage collected - CVE-2026-73637: modauthdigest: don't use a client entry outside the client lock - CVE-2026-48005:...

CLSA-2026-1791538487 httpd: Fix of 17 CVEs

CVE-2026-58415: moddavfs: deny every request for the .DAV state directory from a fixup hook, so the default handler can no longer serve the lock and property databases to GET requests information disclosure - CVE-2026-59797: modssl: restrict the file and filesize functions in SSLRequire...

BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

SUSE CVE-2026-63045

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

CVE-2026-63045

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

Linux Distros Unpatched Vulnerability : CVE-2026-63045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward...