Red Hat Security AdvisoryRHSA-2026:27200
Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update
Released 2026-06-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.62-13.el7jbcs, jbcs-httpd24-httpd-devel-2.4.62-13.el7jbcs, jbcs-httpd24-httpd-manual-2.4.62-13.el7jbcs +10
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-httpd-2.4.62-13.el8jbcs, jbcs-httpd24-httpd-devel-2.4.62-13.el8jbcs, jbcs-httpd24-httpd-manual-2.4.62-13.el8jbcs +10
Fixes 10 records
Priority HIGH 72
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.3295 · Published 2026-06-08 · Fixed CWE-789
Priority MEDIUM 52
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01376 · Published 2026-05-05 · Partial fix CWE-122
Priority MEDIUM 47
Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04963 · Published 2025-07-10 · Fixed CWE-401
Priority MEDIUM 40
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00594 · Published 2026-05-04 · Partial fix CWE-476
Priority MEDIUM 40
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00823 · Published 2026-03-18 · Fixed in 1.68.1 CWE-617
Priority LOW 39
Buffer Over-read vulnerability in Apache HTTP Server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-05-04 · Partial fix CWE-126
Priority LOW 39
Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00628 · Published 2026-05-05 · Fixed CWE-770
Priority LOW 31
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00485 · Published 2026-05-04 · Partial fix CWE-125
Priority LOW 31
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00514 · Published 2026-05-04 · Partial fix CWE-476
Priority LOW 30
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00393 · Published 2026-05-04 · Partial fix CWE-125
THREATIST.IORead the docs