Red Hat Security AdvisoryRHSA-2026:0075
httpd security update
Released 2026-01-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7 ELS) httpd-2.4.6-99.el7_9.7, httpd-devel-2.4.6-99.el7_9.7, httpd-manual-2.4.6-99.el7_9.7 +3
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) mod_ldap-2.4.6-99.el7_9.7, mod_proxy_html-1:2.4.6-99.el7_9.7
Fixes 1 record
Priority MEDIUM 41
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.01526 · Published 2025-12-05 · Fixed in 2.4.66 CWE-201
