Read the docs
Red Hat Security Advisory

RHSA-2025:3452

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 security update

Released 2025-04-02 · Red Hat rating Low · View on Red Hat →

Fixed in

Fixes 3 records

TI-2024-05145 CVE-2024-5535 · GHSA-4fc7-mvrr-wv2c

SSL_select_next_proto buffer overread

Priority MEDIUM 54

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05582 Published 2024-06-27 Partial fix · 3.3.2, 3.2.3 +4 CWE-125
TI-2024-16312 CVE-2024-24795 · GHSA-c4ch-cv96-r58v

Apache HTTP Server: HTTP Response Splitting in multiple modules

Priority LOW 33

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.02874 Published 2024-04-04 Partial fix CWE-113
TI-2024-24173 CVE-2024-36387 · GHSA-463r-p989-2f9j

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

Priority LOW 28

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01715 Published 2024-07-01 Fixed CWE-476