Red Hat Product Security issued an advisory (RHSA-2026:0010) for Apache HTTP Server (httpd) 2.4 packages addressing two vulnerabilities: CVE-2025-55753 in the mod_md module causing unintended retry intervals, and CVE-2025-58098 where Server Side Includes improperly add query strings to the #exec cmd= directive. These issues affect Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support versions. The advisory provides updated packages to remediate these vulnerabilities. No CVSS base scores are included in the advisory, but the severity is rated as Important by Red Hat. The advisory references bugzilla entries 2419140 and 2419365 for the respective CVEs. The update is available via Red Hat's official errata and update channels.

The vulnerabilities affect the Apache HTTP Server 2.4 packages on Red Hat Enterprise Linux 8.4, potentially causing unintended retry behavior in the mod_md module and improper query string handling in Server Side Includes. These issues could lead to unexpected server behavior or information exposure. The exact impact details and exploitability are not provided in the advisory. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated httpd packages for Red Hat Enterprise Linux 8.4 that address these vulnerabilities. Users should apply the official security updates as described in Red Hat article 11258 and the advisory RHSA-2026:0010. The vendor manages remediation through these official patches. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the update.