[ALSA-2026:89860] Important: httpd security update
Type:
security
Severity:
important
Release date:
2026-10-26
Description:
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636) * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686) * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005) * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154) * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 httpd-2.4.63-13.el10_2.8.aarch64.rpm 0cdb7453aa3ad989579ac03c8b811bae690b41b56fe60fff435858962db263d3
aarch64 httpd-core-2.4.63-13.el10_2.8.aarch64.rpm 24d062f26facb9b3c6561dcf90e61580057507ef7ce8fadfe97efd6cd66be93c
aarch64 httpd-tools-2.4.63-13.el10_2.8.aarch64.rpm 406feebef24db7dba47640f8ce09c933bc9730b79899df1addff594c4a10622c
aarch64 httpd-devel-2.4.63-13.el10_2.8.aarch64.rpm 418c40ec62269660507067c1ed17ff526c8015e98960f49bf9747e5b52fff1e4
aarch64 mod_session-2.4.63-13.el10_2.8.aarch64.rpm 68bf00aeec0d4dd402248e0b499b3f9dcb99e1a053fddd21d42ecabd0190545b
aarch64 mod_lua-2.4.63-13.el10_2.8.aarch64.rpm 9ba0273dafcc56fd457c352f4f3f55436cd57d23841642ef7f8907083727208f
aarch64 mod_proxy_html-2.4.63-13.el10_2.8.aarch64.rpm a05e247f7eefe593a127c8f3b6c1cd626d0758ae24692e27ca6ea41469462ef6
aarch64 mod_ldap-2.4.63-13.el10_2.8.aarch64.rpm bb6f6e13e7289beff9e51d27adcfd1d93fd2f89d4cf1e5d5ac8f39bbfbf8d0cc
aarch64 mod_ssl-2.4.63-13.el10_2.8.aarch64.rpm d0abb24bd4bf11ee3c5919795d8ccbb566455d304dad44d963f3d7164c2017b8
noarch httpd-filesystem-2.4.63-13.el10_2.8.noarch.rpm 2b51e057930916d8dbabb095143e5d08565e920ef6bd7a04131e2653be29aeb3
noarch httpd-manual-2.4.63-13.el10_2.8.noarch.rpm 9ecb78a860b304ac15ee8e9aebadd5fd05b179bb0c9c519c39bbf8d122040d39
ppc64le httpd-tools-2.4.63-13.el10_2.8.ppc64le.rpm 23e49e344c025e305bacc3e5842fa2518e532bb84ca423418573a405556293a1
ppc64le httpd-2.4.63-13.el10_2.8.ppc64le.rpm 58ff3cd557d2a68837c42fb27c61f3d3e1eea3413949fe4943abc21eea975645
ppc64le httpd-core-2.4.63-13.el10_2.8.ppc64le.rpm 7539d232b8be734ca70d26889e7db3d558cdeb02890d7fc3771a685e6632eed0
ppc64le mod_ldap-2.4.63-13.el10_2.8.ppc64le.rpm afdc45502bf420bed329ff8a9ca148f02f92e039ddf10c0ff68ea5371939c2c2
ppc64le mod_lua-2.4.63-13.el10_2.8.ppc64le.rpm b3b54100db0ae5a4b5100101dee107bdb9ba2a3e9d59989525baec287f3caa79
ppc64le httpd-devel-2.4.63-13.el10_2.8.ppc64le.rpm bbf6b0c63c0479a6242e67f751a4e5d71039f6b87e9c31c11d3adac2268179d4
ppc64le mod_session-2.4.63-13.el10_2.8.ppc64le.rpm be1be5424f0649cd3b22a175a210c843ad59d786e4635277d7070301809fd152
ppc64le mod_ssl-2.4.63-13.el10_2.8.ppc64le.rpm c9a16997674cbda8dc69c99455823ef91384809327474447b3f470d7272ffb22
ppc64le mod_proxy_html-2.4.63-13.el10_2.8.ppc64le.rpm f722fda0074b8258751af87936fd3ba6fa88734cb834aa677b4a0fa2eb92f91c
s390x mod_lua-2.4.63-13.el10_2.8.s390x.rpm 210cc32c146062ab0da39572b61a835196c9883b9ed5da33108bfd6f8305f665
s390x httpd-tools-2.4.63-13.el10_2.8.s390x.rpm 377ad3d105b61a4ce94320a77f6b1af52739825a9b131648a93ff43505de80f5
s390x httpd-2.4.63-13.el10_2.8.s390x.rpm 3cbed775424bdca32ae187e53435e48790eac96a780e5e88923ec37fd2ef6d51
s390x mod_ldap-2.4.63-13.el10_2.8.s390x.rpm 4b66b8994f71ddf8131e73ec4a6aac715039b7eb36751bb192100f45eb78439d
s390x mod_session-2.4.63-13.el10_2.8.s390x.rpm a31269ba18c37f413e5a4794a645d8ca8a7ec5b8e913e1e57a3c0dd0d102b3d8
s390x mod_ssl-2.4.63-13.el10_2.8.s390x.rpm a738fd79f0c07e15ce6c88132e0940ca80a17ee08b56f3d799bb8eb1055d022f
s390x httpd-devel-2.4.63-13.el10_2.8.s390x.rpm ab6b92e606bfa1117f4a140baed9e09f2a62e34148e68e027edd8bca7656da75
s390x httpd-core-2.4.63-13.el10_2.8.s390x.rpm bd156de7b9664bbdcdde2cb25edd5f1fcddd409ae329cfc983f489fd3fb6bb5e
s390x mod_proxy_html-2.4.63-13.el10_2.8.s390x.rpm da6c697e5660108ae74d7c83667305f532bc2bd8d231c81968f70975e7106c52
x86_64 httpd-devel-2.4.63-13.el10_2.8.x86_64.rpm 013f55c427bb546cd6e0215e5c8daf18ac3cdafcc5fc5365190cf1d245df7a23
x86_64 mod_proxy_html-2.4.63-13.el10_2.8.x86_64.rpm 0e1e711d571abad64c5b9d238554fb8788d9c9e063df074619fe362a909bf844
x86_64 mod_ldap-2.4.63-13.el10_2.8.x86_64.rpm 2abe7ff88a75fc0b6d00e14b782e08a39710e3eb7dcb4bfbd5843c99cd17e154
x86_64 httpd-tools-2.4.63-13.el10_2.8.x86_64.rpm 5e479cdaca3890857ede0693fa6e1dc65cd0a59931855acd3ef991690e008a3c
x86_64 mod_ssl-2.4.63-13.el10_2.8.x86_64.rpm 6e3dd8f1157976984e9a225a754f190c7f0311564c3f496141c46f8020a19b6f
x86_64 httpd-2.4.63-13.el10_2.8.x86_64.rpm 82ca51b60ea07a360e4735c15b2c19ba91ffa9cc1c49edaedb99143e30690f7d
x86_64 mod_session-2.4.63-13.el10_2.8.x86_64.rpm a8ad2cfb9859055c0a44925c362934bc7deecae4b20591fa1b1a75f5025cca65
x86_64 mod_lua-2.4.63-13.el10_2.8.x86_64.rpm afe00b344ded34636af8be43b9a1bc497c5b3612b7dd17528db7b43db48d9aa0
x86_64 httpd-core-2.4.63-13.el10_2.8.x86_64.rpm e21199d6180d44b3c70e5c145fa0e7580a6a97cc3c0a80fb056d17ac23f85362
x86_64_v2 mod_ssl-2.4.63-13.el10_2.8.x86_64_v2.rpm 03239a9e5ff5a1b509276e7cdfead0b3508f1370f6211b25541abafd010e1d42
x86_64_v2 mod_ldap-2.4.63-13.el10_2.8.x86_64_v2.rpm 06939d16de35d6a1972f801daf9d9f9fc990e5c96fd6d5cfbf695ffc57fb0b98
x86_64_v2 mod_proxy_html-2.4.63-13.el10_2.8.x86_64_v2.rpm 13a152d6d2f91720efa3558c9884dbf4772890ef00a24a50dd8341b48cefee80
x86_64_v2 mod_lua-2.4.63-13.el10_2.8.x86_64_v2.rpm 327b97d31e64fa025f3e656211d30dd20150ff2179f5268da680d1df04c3a571
x86_64_v2 mod_session-2.4.63-13.el10_2.8.x86_64_v2.rpm 591ff5d8d6082d0e4a1ca3b74668600282312d446119d86149718c77e87f53be
x86_64_v2 httpd-tools-2.4.63-13.el10_2.8.x86_64_v2.rpm 86eb89bac40c7d640474a4d6664d12094cf34ac977bfacc7654fc7d08d7d6a10
x86_64_v2 httpd-devel-2.4.63-13.el10_2.8.x86_64_v2.rpm 9ef941263f861277a53cfb0465ceca112aafc0614dc27a57082471d7942fbfc9
x86_64_v2 httpd-2.4.63-13.el10_2.8.x86_64_v2.rpm b7197799689ab9a7ddef2cdafb3be784e337a08bfc58036fb16473bd548d499f
x86_64_v2 httpd-core-2.4.63-13.el10_2.8.x86_64_v2.rpm f2b46d9072c65ea5551013e64ce02188928516354efacc3428e420c14e6d3939
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.