Red Hat has issued a security advisory (RHSA-2026:34109) for the Apache HTTP Server (httpd) packages in Red Hat Enterprise Linux 10, addressing multiple vulnerabilities including an incomplete fix for CVE-2023-38709 (now CVE-2024-42516), NULL pointer dereference (CVE-2026-29169), heap-based buffer overflows via malicious backend servers and untrusted content in mod_xml2enc (CVE-2026-34356, CVE-2026-42536), buffer over-read via outbound OCSP requests (CVE-2026-44185), denial of service via crafted regular expressions (CVE-2026-44631), and buffer overflow in mod_proxy_html allowing security bypass (CVE-2026-34355). The advisory also includes fixes for moderate severity issues from httpd 2.4.68. The update is rated as Important by Red Hat Product Security and applies to Red Hat Enterprise Linux 10 across multiple architectures. For detailed impact and CVSS scores, the advisory references individual CVE pages. The vendor provides updated packages to address these vulnerabilities.

The vulnerabilities collectively may lead to denial of service conditions, security bypass, heap-based buffer overflows, and NULL pointer dereferences in the Apache HTTP Server. These issues can affect server stability and security, potentially allowing attackers to cause crashes or bypass security controls. The advisory rates the overall impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated httpd packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the provided security update as detailed in the Red Hat advisory RHSA-2026:34109 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix from the vendor, applying the update is the recommended remediation. Patch status is confirmed as fixed in the updated packages. No additional mitigation steps are specified beyond applying the update.