Read the docs
Red Hat Security Advisory

RHSA-2026:2994

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP3 security update

Released 2026-02-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2025-08462 CVE-2025-9230

Out-of-bounds read & write in RFC 3211 KEK Unwrap

Priority MEDIUM 52

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01499 Published 2025-09-30 Partial fix · 3.5.4, 3.4.3 +5 CWE-125
TI-2025-35937 CVE-2025-58098 · GHSA-4m29-g52g-c6qc

Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

Priority MEDIUM 41

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.01526 Published 2025-12-05 Fixed in 2.4.66 CWE-201
TI-2025-42862 CVE-2025-69419 · GHSA-x77r-97gw-wh89

Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

Priority LOW 35

Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the alloca…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00607 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +4 CWE-787
TI-2025-35173 CVE-2025-55753 · GHSA-3j5h-f552-7rhh

Apache HTTP Server: mod_md (ACME), unintended retry intervals

Priority LOW 33

An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00483 Published 2025-12-05 Fixed in 2.4.66 CWE-190
TI-2025-40235 CVE-2025-65082 · GHSA-768g-4qpg-32w7

Apache HTTP Server: CGI environment variable override

Priority LOW 30

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00865 Published 2025-12-05 Partial fix CWE-150