Red Hat Security Advisory

RHSA-2026:17080

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-05-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images httpd-2.4.67-1.hum1@aarch64, httpd-2.4.67-1.hum1@src, httpd-2.4.67-1.hum1@x86_64 +10

Fixes 3 records

TI-2026-23287 CVE-2026-29169 · GHSA-jmv5-rcpx-7f7r

Apache HTTP Server: mod_dav_lock indirect lock crash

MEDIUM 40

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00594 Published 2026-05-04 Partial fix CWE-476

TI-2026-25916 CVE-2026-33523 · GHSA-fc75-39v4-qm5p

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

LOW 35

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00436 Published 2026-05-04 Partial fix CWE-443

TI-2026-25454 CVE-2026-33006 · GHSA-r3x7-65m7-5p92

Apache HTTP Server: mod_auth_digest timing attack

LOW 23

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00557 Published 2026-05-04 Partial fix CWE-208