Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 3, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section. Security Fix(es): * httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) * jbcs-httpd24-httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) * jbcs-httpd24-mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) * mod_proxy_ajp.so: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * mod_proxy_ajp.so: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * mod_authn_socache.so: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * mod_proxy_ajp.so: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * mod_dav_lock.so: NULL pointer dereference via specially crafted request (CVE-2026-29169) * jbcs-httpd24-mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) * jbcs-httpd24-httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * jbcs-httpd24-openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group (CVE-2026-2673) * libexpat-2.dll: denial of service via crafted XML input (CVE-2026-45186) * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This Red Hat security advisory covers a set of vulnerabilities in Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4, which is a component common to multiple JBoss middleware products. The vulnerabilities include arbitrary code execution via a heap-based buffer overflow in mod_proxy_ajp (CVE-2026-28780), multiple remote denial of service (DoS) issues via HTTP/2 compression bomb and Slowloris-style attacks (CVE-2026-49975, CVE-2025-53020), heap-based buffer over-reads and memory disclosure in mod_proxy_ajp (CVE-2026-34032, CVE-2026-34059), NULL pointer dereferences causing process crashes (CVE-2026-33007, CVE-2026-29169), resource exhaustion via unrestricted OCSP response (CVE-2026-29168), DoS via malformed HTTP/2 frames (CVE-2026-27135), OpenSSL TLS 1.3 key agreement group selection issue (CVE-2026-2673), denial of service via crafted XML input in libexpat (CVE-2026-45186), and information disclosure from uninitialized memory in OpenSSL (CVE-2026-31790). Red Hat has released this update as a replacement for the previous service pack to address these issues.
Potential Impact
The vulnerabilities fixed in this update could allow attackers to execute arbitrary code, cause denial of service conditions, disclose sensitive memory contents, or exhaust system resources. Specifically, arbitrary code execution in mod_proxy_ajp could lead to full compromise of the affected server. Denial of service vulnerabilities could disrupt availability through resource exhaustion or malformed protocol frames. Information disclosure issues could leak sensitive cryptographic material or memory contents. Process crashes due to NULL pointer dereferences could affect stability. Overall, these issues pose significant risks to the confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
Red Hat has released Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 as an official fix addressing these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are indicated beyond applying this update.
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update
Description
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 3, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section. Security Fix(es): * httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) * jbcs-httpd24-httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) * jbcs-httpd24-mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) * mod_proxy_ajp.so: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * mod_proxy_ajp.so: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * mod_authn_socache.so: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * mod_proxy_ajp.so: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * mod_dav_lock.so: NULL pointer dereference via specially crafted request (CVE-2026-29169) * jbcs-httpd24-mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) * jbcs-httpd24-httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * jbcs-httpd24-openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group (CVE-2026-2673) * libexpat-2.dll: denial of service via crafted XML input (CVE-2026-45186) * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory covers a set of vulnerabilities in Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4, which is a component common to multiple JBoss middleware products. The vulnerabilities include arbitrary code execution via a heap-based buffer overflow in mod_proxy_ajp (CVE-2026-28780), multiple remote denial of service (DoS) issues via HTTP/2 compression bomb and Slowloris-style attacks (CVE-2026-49975, CVE-2025-53020), heap-based buffer over-reads and memory disclosure in mod_proxy_ajp (CVE-2026-34032, CVE-2026-34059), NULL pointer dereferences causing process crashes (CVE-2026-33007, CVE-2026-29169), resource exhaustion via unrestricted OCSP response (CVE-2026-29168), DoS via malformed HTTP/2 frames (CVE-2026-27135), OpenSSL TLS 1.3 key agreement group selection issue (CVE-2026-2673), denial of service via crafted XML input in libexpat (CVE-2026-45186), and information disclosure from uninitialized memory in OpenSSL (CVE-2026-31790). Red Hat has released this update as a replacement for the previous service pack to address these issues.
Potential Impact
The vulnerabilities fixed in this update could allow attackers to execute arbitrary code, cause denial of service conditions, disclose sensitive memory contents, or exhaust system resources. Specifically, arbitrary code execution in mod_proxy_ajp could lead to full compromise of the affected server. Denial of service vulnerabilities could disrupt availability through resource exhaustion or malformed protocol frames. Information disclosure issues could leak sensitive cryptographic material or memory contents. Process crashes due to NULL pointer dereferences could affect stability. Overall, these issues pose significant risks to the confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
Red Hat has released Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 as an official fix addressing these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are indicated beyond applying this update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:22140
- Cve Count
- 6
- Additional Cves
- ["CVE-2026-28780","CVE-2026-33007","CVE-2026-33857","CVE-2026-34032","CVE-2026-34059"]
- Cvss Version
- null
Threat ID: 6a1df668e29bf47b50460cfa
Added to database: 06/01/2026, 21:15:20 UTC
Last enriched: 07/30/2026, 15:11:56 UTC
Last updated: 07/31/2026, 19:22:55 UTC
Views: 355
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.