RHSA-2026:27201

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

Buffer Over-read vulnerability in Apache HTTP Server.

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data.

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword.

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.

Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server.