Threat Intelligence Database

CVE-2026-42536 is a heap-based buffer overflow vulnerability in Apache HTTP Server's mod_xml2enc module when processing untrusted content. This affects Apache HTTP Server versions from 2.4.0 up to but not including 2.4.68. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with an impact on availability but no direct confidentiality or integrity impact. Red Hat has issued security advisories providing updated packages that fix this issue. Users are strongly recommended to upgrade to version 2.4.68 or later to mitigate this vulnerability.

CVE-2026-34355 is a heap-based buffer overflow vulnerability in the mod_proxy_html module of Apache HTTP Server versions 2.4.67 and earlier. This flaw allows an untrusted backend to trigger a buffer overflow, potentially leading to a security bypass. The issue is resolved in Apache HTTP Server version 2.4.68. Users are advised to upgrade to this fixed version to mitigate the risk.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

This advisory addresses two security vulnerabilities in the Apache HTTP Server (httpd) 2.4 packages provided by Red Hat Enterprise Linux 8.8. The first vulnerability (CVE-2025-55753) involves unintended retry intervals in the mod_md (ACME) module. The second vulnerability (CVE-2025-58098) concerns the Server Side Includes feature adding query strings to the #exec cmd= directive. Red Hat has released an important security update to fix these issues in the httpd:2.4 packages for Red Hat Enterprise Linux 8.8.

Red Hat has issued a security advisory for the Apache HTTP Server (httpd) version 2.4 packages included in Red Hat Enterprise Linux 8.4. The update addresses two vulnerabilities: CVE-2025-55753 affecting the mod_md (ACME) module with unintended retry intervals, and CVE-2025-58098 where Server Side Includes improperly adds query strings to the #exec cmd directive. These issues have been rated with an important security impact by Red Hat Product Security.

This advisory addresses two security vulnerabilities in the Apache HTTP Server (httpd) 2.4 packages provided by Red Hat Enterprise Linux 8.2. The first vulnerability (CVE-2025-55753) involves unintended retry intervals in the mod_md (ACME) module. The second vulnerability (CVE-2025-58098) concerns the Server Side Includes feature adding query strings to the #exec cmd directive. Red Hat has released an update for the httpd:2.4 module to fix these issues.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section. Security Fix(es): * httpd: HTTP Session Hijack via a TLS upgrade [jbcs-httpd-2.4] (CVE-2025-49812) * httpd: access control bypass by trusted clients is possible using TLS 1.3 session resumption [jbcs-httpd-2.4] (CVE-2025-23048) * httpd: insufficient escaping of user-supplied data in mod_ssl [jbcs-httpd-2.4] (CVE-2024-47252) * httpd: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module [jbcs-httpd-2.4] (CVE-2025-49630) * jbcs-httpd24-mod_security: ModSecurity Has Possible DoS Vulnerability [jbcs-httpd-2.4] (CVE-2025-47947) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.