Threats Tagged 'cve-2026-6238'

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Technology Preview features are not fully supported, may not be functionally complete, and are not suitable for deployment in production.

This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * None Known issues: * None

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None

This update includes the following RPMs: glibc: * compat-libpthread-nonshared-2.42-12.hum1 (aarch64, x86_64) * glibc-2.42-12.hum1 (aarch64, x86_64) * glibc-all-langpacks-2.42-12.hum1 (aarch64, x86_64) * glibc-benchtests-2.42-12.hum1 (aarch64, x86_64) * glibc-common-2.42-12.hum1 (aarch64, x86_64) * glibc-devel-2.42-12.hum1 (aarch64, x86_64) * glibc-doc-2.42-12.hum1 (noarch) * glibc-gconv-extra-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-aa-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-af-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-agr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ak-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-am-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-an-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-anp-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ar-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-as-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ast-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ayc-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-az-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-be-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bem-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ber-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bg-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bhb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bho-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bn-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bo-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-br-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-brx-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bs-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-byn-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ca-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ce-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-chr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ckb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cmn-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-crh-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cs-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-csb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cv-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cy-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-da-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-de-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-doi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-dsb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-dv-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-dz-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-el-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-en-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-eo-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-es-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-et-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-eu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fa-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ff-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fil-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fo-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fur-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fy-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ga-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gbm-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gd-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gez-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gl-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gv-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ha-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hak-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-he-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hif-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hne-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hsb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ht-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hy-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ia-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-id-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ig-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ik-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-is-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-it-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-iu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ja-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ka-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-kab-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-kk-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-kl-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-km-2.4

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.