Read the docs
Red Hat Security Advisory

RHSA-2026:89860

httpd security update

Released 2026-10-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 11 records

TI-2026-40530 CVE-2026-56154 · GHSA-f5cw-5j88-wxxc

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Priority MEDIUM 50

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00536 Published 2026-10-01 Partial fix CWE-416
TI-2026-45138 CVE-2026-63292 · GHSA-f6c9-29xf-9j37

Apache HTTP Server: mod_vhost_alias stack overflow

Priority MEDIUM 41

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code vi…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00948 Published 2026-10-01 Partial fix CWE-121
TI-2026-63026 CVE-2026-93546 · GHSA-x37v-wq26-vjw7

Apache HTTP Server: mod_dav_fs namespace overflow

Priority MEDIUM 40

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00429 Published 2026-10-01 Partial fix CWE-190
TI-2026-35450 CVE-2026-48005 · GHSA-cf5c-qxgw-xx3p

Apache HTTP Server: mod_auth_digest reauthentication attack

Priority MEDIUM 40

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authenticat…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00565 Published 2026-10-01 Partial fix CWE-306
TI-2026-45310 CVE-2026-63718 · GHSA-9fgx-g8xr-w8vf

Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Priority LOW 39

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00434 Published 2026-10-01 Partial fix CWE-444
TI-2026-45300 CVE-2026-63686 · GHSA-h4g4-79cj-82qx

Apache HTTP Server: mod_xml2enc crash on charset conversion failure

Priority LOW 39

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a char…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-10-01 Partial fix CWE-476
TI-2026-45021 CVE-2026-63045 · GHSA-6wv6-863r-87j4

Apache HTTP Server: mod_proxy_ftp PASV address handling

Priority LOW 39

Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause th…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00441 Published 2026-10-01 Partial fix CWE-284
TI-2026-34354 CVE-2026-46729 · GHSA-539q-64x2-q4mg

Apache HTTP Server: mod_heartmonitor denial of service

Priority LOW 39

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00451 Published 2026-10-01 Partial fix CWE-476
TI-2026-51721 CVE-2026-73637 · GHSA-gr5c-77fq-wx32

Apache HTTP Server: mod_auth_digest DoS attack

Priority LOW 38

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest aut…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00466 Published 2026-10-01 Partial fix CWE-416
TI-2026-51720 CVE-2026-73636 · GHSA-x3h4-7828-fv9v

Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

Priority LOW 37

Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication crede…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00397 Published 2026-10-01 Partial fix CWE-294