TI-2026-19263 CVE-2026-23918 · GHSA-p8fm-9c82-pw4g
Apache HTTP Server: http2: double free and possible RCE on early reset
Priority HIGH 71
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
RHSA-2026:13938
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-05-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images httpd-2.4.67-0.1.hum1@aarch64, httpd-2.4.67-0.1.hum1@src, httpd-2.4.67-0.1.hum1@x86_64 +10
Fixes 6 records
TI-2026-19399 CVE-2026-24072 · GHSA-9pw3-5ggm-c92r
Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
Priority MEDIUM 41
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.
TI-2026-26384 CVE-2026-34059 · GHSA-m35f-pf48-r38q
Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
Priority LOW 39
Buffer Over-read vulnerability in Apache HTTP Server.
TI-2026-26358 CVE-2026-34032 · GHSA-9r79-gvhp-cr42
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Priority LOW 31
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
TI-2026-25455 CVE-2026-33007 · GHSA-cj6w-grf6-jq78
Apache HTTP Server: mod_authn_socache crash
Priority LOW 31
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.
TI-2026-26223 CVE-2026-33857 · GHSA-v5qg-p44g-5728
Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
Priority LOW 30
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server.