httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

Critical: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: httpd: httpd-2.4.71-0.1.hum1 aarch64, s390x, x8664 httpd-core-2.4.71-0.1.hum1 aarch64, s390x, x8664 httpd-devel-2.4.71-0.1.hum1 aarch64, s390x, x8664 httpd-filesystem-2.4.71-0.1.hum1 noarch...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

EulerOS Virtualization 2.15.0 : httpd (EulerOS-SA-2026-4819)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A buffer overflow in modproxyhtml in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.Users are...

RHEL 7 : httpd (RHSA-2026:92590)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92590 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

Important: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

Astra Linux – vulnerability in Apache2

A buffer overflow in modproxyhtml in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Updated apache package fixes security vulnerabilities

Limited RCE for some internal redirects to non-CGI files in CGI directories. CVE-2026-42356 moddav shared lock overflow. CVE-2026-42528 modheartmonitor denial of service. CVE-2026-46729 modsession: Session cookie not removed during internal redirect. CVE-2026-47360 modauthdigest reauthentication...

SUSE CVE-2026-56449

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68...

K000163653: Apache HTTP Server vulnerabilities CVE-2026-56449 and CVE-2026-57941

Security Advisory Description CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's modhttp2 via...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791471297)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791471297 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791471297)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791471297 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache...

Rocky Linux 10.2 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc (crlba-2026_50158)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlba-202650158 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Bug Fixes and Enhancements: modproxyhtml regression in...

httpd bug fix and enhancement update

An update is available for httpd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

CLSA-2026-1791471297 httpd: Fix of 5 CVEs

CVE-2026-56153: modcharsetlite: bound the partial character buffer in finishpartialchar - CVE-2026-46729: modheartmonitor: validate the heartbeat POST body and query - CVE-2026-56154: modrewrite: copy the lookahead Vary value out of the subrequest pool - CVE-2026-56449: modproxyhtml: don't dump...

CLSA-2026-1791482084 Fix of 7 CVEs

SECURITY UPDATE: modcharsetlite: heap overflow in finishpartialchar - debian/patches/CVE-2026-56153.patch: modcharsetlite: heap overflow in finishpartialchar - CVE-2026-56153 SECURITY UPDATE: modheartmonitor: NULL pointer dereference on malformed heartbeat - debian/patches/CVE-2026-46729.patch:...

CLSA-2026-1791447288 Fix of 5 CVEs

SECURITY UPDATE: out-of-bounds write in modcharsetlite - debian/patches/CVE-2026-56153.patch: in finishpartialchar in modules/filters/modcharsetlite.c, stop accumulating a split multibyte character once ctx-saved reaches the size of ctx-buf so the next byte can no longer be written past the 8-byt...

CLSA-2026-1791396690 httpd: Fix of 5 CVEs

CVE-2026-56153: fix modcharsetlite heap overflow in finishpartialchar - CVE-2026-46729: fix modheartmonitor NULL pointer dereference in the heartbeat handler - CVE-2026-56154: fix modrewrite use-after-free with LA-U/LA-F lookahead of HTTP headers - CVE-2026-56449: fix modproxyhtml out-of-bounds...