Red Hat Security AdvisoryRHSA-2026:36831
httpd:2.4 security update
Released 2026-07-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) httpd-2.4.37-47.module+el8.6.0+24496+af8fe930.13.src::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+24496+af8fe930.13.x86_64::httpd:2.4, httpd-devel-2.4.37-47.module+el8.6.0+24496+af8fe930.13.x86_64::httpd:2.4 +11
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) httpd-2.4.37-47.module+el8.6.0+24496+af8fe930.13.src::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+24496+af8fe930.13.x86_64::httpd:2.4, httpd-devel-2.4.37-47.module+el8.6.0+24496+af8fe930.13.x86_64::httpd:2.4 +11
Fixes 7 records
Priority HIGH 72
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.3295 · Published 2026-06-08 · Fixed CWE-789
Priority MEDIUM 52
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01376 · Published 2026-05-05 · Partial fix CWE-122
Priority MEDIUM 47
Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04963 · Published 2025-07-10 · Fixed CWE-401
Priority LOW 39
Buffer Over-read vulnerability in Apache HTTP Server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-05-04 · Partial fix CWE-126
Priority LOW 31
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00485 · Published 2026-05-04 · Partial fix CWE-125
Priority LOW 31
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00514 · Published 2026-05-04 · Partial fix CWE-476
Priority LOW 30
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00393 · Published 2026-05-04 · Partial fix CWE-125
THREATIST.IORead the docs