This advisory covers several security flaws in Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 and associated modules such as mod_http2 and mod_proxy_ajp. Notable vulnerabilities include CVE-2025-53020 (HTTP/2 DoS by memory increase), CVE-2026-49975 (HTTP/2 remote DoS via compression bomb and Slowloris-style attack), CVE-2026-48913 (use-after-free in mod_http2 allowing arbitrary code execution or DoS), and CVE-2026-28780 (heap-based buffer overflow in mod_proxy_ajp enabling arbitrary code execution). Additional issues involve out-of-bounds reads, NULL pointer dereferences, and resource exhaustion. These vulnerabilities impact HTTP/2 protocol handling, memory management, and request parsing, potentially leading to denial of service or code execution. The Red Hat advisory provides updated packages that fix these issues.

The vulnerabilities can lead to denial of service conditions through memory exhaustion or crashes, and in some cases, allow arbitrary code execution on affected systems. Specifically, attackers could exploit HTTP/2 protocol handling flaws to cause resource exhaustion or use-after-free bugs to execute code remotely. Heap-based buffer overflows in mod_proxy_ajp also pose a risk of arbitrary code execution. These impacts can compromise availability and potentially confidentiality and integrity of affected systems running the vulnerable Apache HTTP Server components.

Red Hat has released updated packages for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 that address these vulnerabilities. Users should apply these official security updates promptly. Before applying the update, ensure all previously released errata relevant to the system are applied. Detailed update instructions are available from Red Hat. No additional mitigations are specified beyond applying the provided patches.