CVE-2026-42536 is a heap-based buffer overflow vulnerability in Apache HTTP Server's mod_xml2enc module when processing untrusted content. This affects Apache HTTP Server versions from 2.4.0 up to but not including 2.4.68. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with an impact on availability but no direct confidentiality or integrity impact. Red Hat has issued security advisories providing updated packages that fix this issue. Users are strongly recommended to upgrade to version 2.4.68 or later to mitigate this vulnerability.
CVE-2026-34355 is a heap-based buffer overflow vulnerability in the mod_proxy_html module of Apache HTTP Server versions 2.4.67 and earlier. This flaw allows an untrusted backend to trigger a buffer overflow, potentially leading to a security bypass. The issue is resolved in Apache HTTP Server version 2.4.68. Users are advised to upgrade to this fixed version to mitigate the risk.
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
* httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
* httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
* httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
* Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This advisory addresses two security vulnerabilities in the Apache HTTP Server (httpd) 2.4 packages provided by Red Hat Enterprise Linux 8.8. The first vulnerability (CVE-2025-55753) involves unintended retry intervals in the mod_md (ACME) module. The second vulnerability (CVE-2025-58098) concerns the Server Side Includes feature adding query strings to the #exec cmd= directive. Red Hat has released an important security update to fix these issues in the httpd:2.4 packages for Red Hat Enterprise Linux 8.8.
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.
This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.
Security Fix(es):
* httpd: HTTP Session Hijack via a TLS upgrade [jbcs-httpd-2.4] (CVE-2025-49812)
* httpd: access control bypass by trusted clients is possible using TLS 1.3 session resumption [jbcs-httpd-2.4] (CVE-2025-23048)
* httpd: insufficient escaping of user-supplied data in mod_ssl [jbcs-httpd-2.4] (CVE-2024-47252)
* httpd: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module [jbcs-httpd-2.4] (CVE-2025-49630)
* jbcs-httpd24-mod_security: ModSecurity Has Possible DoS Vulnerability [jbcs-httpd-2.4] (CVE-2025-47947)
A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A moderate severity vulnerability (CVE-2025-49812) affecting the Apache HTTP Server (httpd) packages in Red Hat Enterprise Linux 6 and 7.7 allows HTTP session hijacking via a TLS upgrade. Red Hat has issued security advisories and updates to address this issue. The vulnerability is related to improper handling of TLS upgrade requests, potentially allowing an attacker to hijack HTTP sessions.
SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.
Users are recommended to upgrade to version 2.4.64 which fixes this issue.
A security vulnerability (CVE-2024-38476) affecting the Apache HTTP Server (httpd) has been identified. The issue involves security problems caused by backend applications whose response headers are malicious or exploitable. This vulnerability affects certain versions of the httpd package used in Red Hat Enterprise Linux 8.4 and related distributions. A security update addressing this issue has been released by Red Hat. The vulnerability is rated as having high severity by the original report, but Red Hat rates the update as important. No CVSS score is provided in the available data.
Red Hat has issued a security advisory for the Apache HTTP Server (httpd) packages addressing two vulnerabilities: an encoding problem in mod_proxy (CVE-2024-38473) and a potential server-side request forgery (SSRF) in mod_rewrite (CVE-2024-39573). These issues affect Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The update is rated as having a moderate security impact. Red Hat has released updated packages to fix these vulnerabilities.