This security advisory covers Red Hat JBoss Core Services Apache HTTP Server 2.4.62, which addresses three vulnerabilities: CVE-2024-24795 (HTTP Response Splitting in multiple modules), CVE-2024-36387 (denial of service caused by null pointer dereference in mod_http2 websocket over HTTP/2), and CVE-2024-5535 (OpenSSL SSL_select_next_proto buffer overread). The update replaces version 2.4.57 Service Pack 6 and is intended to provide a consistent and faster update experience across JBoss middleware products. Red Hat rates the security impact as low and no exploits in the wild are known. The advisory includes detailed release notes and references for further information.

The vulnerabilities fixed in this update have a low security impact according to Red Hat Product Security. They include potential HTTP response splitting, denial of service via null pointer dereference, and a buffer overread in OpenSSL. No known active exploitation has been reported. The issues could potentially affect the stability and security of the Apache HTTP Server component within Red Hat JBoss Core Services but are not considered critical or high severity.

An official security update to Red Hat JBoss Core Services Apache HTTP Server 2.4.62 is available and should be applied to affected systems. Red Hat advises ensuring all previously released errata are applied before updating. No additional mitigation actions are indicated beyond applying this update. The vendor advisory provides detailed instructions for applying the update.