Red Hat Product Security issued an advisory (RHSA-2026:0012) for Apache HTTP Server (httpd) 2.4 on Red Hat Enterprise Linux 8.8, addressing two vulnerabilities: CVE-2025-55753 in the mod_md module causing unintended retry intervals, and CVE-2025-58098 where Server Side Includes improperly add query strings to the #exec cmd= directive. These vulnerabilities have been fixed in updated httpd packages. The advisory rates the security impact as Important. No CVSS scores are provided in the advisory, and no known exploits in the wild are reported. The update is available for Red Hat Enterprise Linux 8.8 variants including Extended Life Cycle Long Life, Update Services for SAP Solutions, and Telecommunications Update Service.

The vulnerabilities affect the Apache HTTP Server 2.4 packages on Red Hat Enterprise Linux 8.8. The mod_md issue could cause unintended retry intervals potentially impacting ACME certificate management. The Server Side Includes vulnerability could lead to unintended query string injection in the #exec cmd= directive, which may affect server behavior or security. The advisory classifies the impact as Important but does not provide detailed CVSS metrics or confirmed exploitation in the wild.

Red Hat has released updated httpd:2.4 packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:0012 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official fix, applying the update is the recommended mitigation. No additional vendor instructions indicate that no action is required or that the issue is already mitigated without patching.