Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: httpd: httpd-2.4.69-1.hum1 aarch64, x8664 httpd-core-2.4.69-1.hum1 aarch64, x8664 httpd-devel-2.4.69-1.hum1 aarch64, x8664 httpd-filesystem-2.4.69-1.hum1 noarch httpd-manual-2.4.69-1.hum1 noarch...

CVE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

CVE-2026-47360

The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability within the mod_session_cookie module. The root cause is that when the SessionCookieRemove directive changes across internal redirects, the session c...

CVE-2021-26690---Apache-mod_session

Patch-диффинг для CVE-2021-26690 - Apache modsession Эта уязвимость представляет собой разыменование нулевого указателя в модуле modsession Apache. Это вызовет отказ в обслуживании дочерних процессов httpd Apache. С помощью повторяющегося цикла все рабочие процессы Apache будут аварийно...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.0 to 2.4.46: A specially crafted Cookie header handled by modsession can lead to a NULL pointer derefrence error and system crash, potentially causing a Denial Of Service attack...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: httpd: httpd-2.4.67-1.hum1 aarch64, x8664 httpd-core-2.4.67-1.hum1 aarch64, x8664 httpd-devel-2.4.67-1.hum1 aarch64, x8664 httpd-filesystem-2.4.67-1.hum1 noarch httpd-manual-2.4.67-1.hum1 noarch...

MiracleLinux 8 : httpd:2.4 (AXSA:2021-2483:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2483:01 advisory. httpd: modproxy: SSRF via a crafted request uri-path containing unix: CVE-2021-40438 httpd: modsession: Heap overflow via a crafted SessionHeader...

EUVD-2018-8963

Malware in sbrugna...

EUVD-2018-11901

Malware in sbrugna...

Rocky Linux 9 : httpd (RLSA-2024:5138)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:5138 advisory. httpd: Security issues via?backend applications whose response headers are malicious or exploitable CVE-2024-38476 Tenable has extracted the preceding descriptio...

BIT-APACHE-2021-26690 mod_session NULL pointer dereference

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by modsession can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service...

Rocky Linux 8 : httpd:2.4 (RLSA-2021:1809)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1809 advisory. - In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry...

CLSA-2023-1696536930 httpd: Fix of 4 CVEs

CVE-2021-26690: Fix NULL pointer dereference in modsession - CVE-2022-22719: Fix possible process crash due to unnoticed failures in modlua - CVE-2022-29404: Fix possible DoS due to no default limit on possible input size in modlua - CVE-2022-26377: Fix possible HTTP request smuggling in...

Advisory ROSA-SA-2023-2159

Software: httpd 2.4.37 OS: ROSA Virtualization 2.1 packageevrstring: 2.4.37 CVE-ID: CVE-2006-20001 BDU-ID: 2023-01105 CVE-Crit: HIGH CVE-DESC: A vulnerability in the moddav module of the Apache HTTP Server web server is related to an operation exceeding buffer boundaries. Exploitation of the...

httpd security update

2.4.6-98.0.3 - modproxy: approxyhttprequest to clear hop-by-hop first and fixup last CVE-2022-31813Orabug: 34381850 - modsession: save one aprstrtok Orabug: 33338149CVE-2021-26690 2.4.6-98.0.1 - replace index.html with Oracle's index page oracleindex.html 2.4.6-97.7 - Resolves: 2177742 -...

CBL Mariner 2.0 Security Update: httpd (CVE-2021-26690)

The version of httpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-26690 advisory. - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by modsession can cause...

K54296221: Apache httpd vulnerability CVE-2018-17199

Security Advisory Description In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...

K32305110: mod_session vulnerability CVE-2021-26691

Security Advisory Description In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow CVE-2021-26691 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product...

httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

CentOS Errata and Security Advisory CESA-2022:1045 An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

httpd security update

2.4.6-97.0.5.5 - modsession: save one aprstrtok Orabug: 33338149CVE-2021-26690 - replace index.html with Oracle's index page oracleindex.html 2.4.6-97.5 - Resolves: 2065243 - CVE-2022-22720 httpd: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier...