Red Hat Security Advisory

RHSA-2024:2891

httpd:2.4 security update

Released 2024-05-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.8) httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.aarch64::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.ppc64le::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.s390x::httpd:2.4 +38

TI-2024-18154 CVE-2024-27316 · GHSA-5qc4-82jh-h385

HIGH 81

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.88755 Published 2024-04-04 Partial fix CWE-770

TI-2023-24564 CVE-2023-45802 · GHSA-m4mp-v249-x3mh

LOW 32

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03168 Published 2023-10-23 Partial fix CWE-404