Threats Tagged 'cve-2026-49975'

Red Hat OpenShift Service Mesh 3.2.6, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Security Fix(es): * openshift-service-mesh/istio-proxyv2-rhel9: envoy: HTTP/2 Remote Denial of Service via HPACK compression bomb and Slowloris-style attack (CVE-2026-47774)

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update includes the following RPMs: httpd: * httpd-2.4.68-1.hum1 (aarch64, x86_64) * httpd-core-2.4.68-1.hum1 (aarch64, x86_64) * httpd-devel-2.4.68-1.hum1 (aarch64, x86_64) * httpd-filesystem-2.4.68-1.hum1 (noarch) * httpd-manual-2.4.68-1.hum1 (noarch) * httpd-tools-2.4.68-1.hum1 (aarch64, x86_64) * mod_ldap-2.4.68-1.hum1 (aarch64, x86_64) * mod_lua-2.4.68-1.hum1 (aarch64, x86_64) * mod_proxy_html-2.4.68-1.hum1 (aarch64, x86_64) * mod_session-2.4.68-1.hum1 (aarch64, x86_64) * mod_ssl-2.4.68-1.hum1 (aarch64, x86_64) * httpd-2.4.68-1.hum1.src (src)

This update includes the following RPMs: httpd: * httpd-2.4.68-1.hum1 (aarch64, x86_64) * httpd-core-2.4.68-1.hum1 (aarch64, x86_64) * httpd-devel-2.4.68-1.hum1 (aarch64, x86_64) * httpd-filesystem-2.4.68-1.hum1 (noarch) * httpd-manual-2.4.68-1.hum1 (noarch) * httpd-tools-2.4.68-1.hum1 (aarch64, x86_64) * mod_ldap-2.4.68-1.hum1 (aarch64, x86_64) * mod_lua-2.4.68-1.hum1 (aarch64, x86_64) * mod_proxy_html-2.4.68-1.hum1 (aarch64, x86_64) * mod_session-2.4.68-1.hum1 (aarch64, x86_64) * mod_ssl-2.4.68-1.hum1 (aarch64, x86_64) * httpd-2.4.68-1.hum1.src (src)

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.