Red Hat Security Advisory: Insights proxy Container Image

The Red Hat Security Advisory RHSA-2026:41906 and RHSA-2026:34109 describe security updates for the Apache HTTP Server (httpd) packages in Red Hat Enterprise Linux 9 and 10. The updates address several vulnerabilities including an incomplete fix for CVE-2023-38709 (now CVE-2024-42516), privilege escalation through .htaccess file manipulation (CVE-2026-24072), timing attacks bypassing digest authentication (CVE-2026-33006), NULL pointer dereference (CVE-2026-29169), heap-based buffer overflows via malicious backend servers and untrusted content (CVE-2026-34356, CVE-2026-42536), buffer over-read via OCSP requests (CVE-2026-44185), denial of service through crafted regular expressions and path handling issues (CVE-2026-44631, CVE-2026-42535), buffer overflow allowing security bypass (CVE-2026-34355), out-of-bounds reads (CVE-2026-43951), and local .htaccess authors reading files with httpd user privileges (CVE-2026-44119). These vulnerabilities impact the Insights proxy container used for routing Red Hat Insights traffic in disconnected or air-gapped environments. The advisory provides updated packages for affected Red Hat Enterprise Linux versions and related components.

The vulnerabilities collectively allow for privilege escalation, authentication bypass, denial of service, memory corruption (heap-based buffer overflows and buffer over-reads), and unauthorized file access within the Apache HTTP Server environment. This could compromise the confidentiality, integrity, and availability of systems running the affected httpd packages and the Red Hat Insights proxy container. The impact is rated as high by Red Hat Product Security.

Red Hat has released updated httpd packages for Red Hat Enterprise Linux 9 and 10 that address these vulnerabilities. Users should apply these official security updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. The advisory indicates these fixes are official and should be deployed to remediate the issues. No additional mitigations or workarounds are specified beyond applying the updates.