[ALSA-2026:92616] Important: httpd:2.4 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-10-30
Description:
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006) * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636) * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686) * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005) * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154) * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153) Bug Fix(es) and Enhancement(s): * mod_proxy_hcheck: passing health check does not recover worker from its standard error state (PROXY_WORKER_IN_ERROR) (JIRA:RHEL-256797) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 mod_md-2.0.8-8.module_el8.10.0+4295+280de5aa.4.aarch64.rpm 11c43831ab5523435fa6faf809e7268c34de0f5ef3700c80e08b5b23e28c0738
aarch64 mod_proxy_html-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.aarch64.rpm 1bd01a4e0486b1b68057d18a206c2ea1ef1f82ff19d650a3396eb36187c5280a
aarch64 mod_session-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.aarch64.rpm 4f393e1f3520a3bd4a0b58fc24dec88130ab765ef79fdf6351b9d33cc3dd96d7
aarch64 httpd-devel-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.aarch64.rpm 87ab1bf3ab810572a69e8ac13df4932a352483349c924cce10d1be8fe72fcebe
aarch64 mod_http2-1.15.7-10.module_el8.10.0+4270+e5f13fdb.7.aarch64.rpm 9ee357754750c69d09c4e0f8e39434e7725e671bb0bca833df9542b672a606b7
aarch64 httpd-tools-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.aarch64.rpm 9f5057455e6e3979f3a3eaed1d307bc904d9ad40714fa84ae0fa45e9a226c7b4
aarch64 mod_ssl-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.aarch64.rpm b6ac6308acc749d2d976a66fe22c0e3d454bc72e0925a4931b1b53d43085164a
aarch64 httpd-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.aarch64.rpm b941671fd500a2f12ac5683d6903cb0f04183662a08fecefee4c730a8c55d88c
aarch64 mod_ldap-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.aarch64.rpm cbd4286570127212fcdf3d2d683729389d8dd356e9900b0958e7599818676917
noarch httpd-manual-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.noarch.rpm 49a741985b2f637f41d6a225ff164c0524058a1ddeaaf58701440b16281a54fa
noarch httpd-filesystem-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.noarch.rpm a2d61622c585098fc72d1e556b6a5b7653749410d88939f22ee64ea855245dab
ppc64le mod_ldap-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.ppc64le.rpm 3efbd576dfd10de5fc714f602734b13d4df5add10ee584beaa70fd9d843d8bab
ppc64le mod_http2-1.15.7-10.module_el8.10.0+4233+8b7d9181.7.ppc64le.rpm 4a900481c319467ddffa19ce6c06d1283471badaf2abf6167d118547aacb0472
ppc64le mod_session-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.ppc64le.rpm 526774cea47f6f2918148a6bbe641c9634cc9c38edac09a9166b00e524ef4d2c
ppc64le httpd-devel-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.ppc64le.rpm 6163c0ec5c5bbcae6ae6a5d48af3cf3e7a7cf974057a3fa134588b5806c05a4a
ppc64le httpd-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.ppc64le.rpm a996dc9e4e40b29538309d637537ee25cf21312b1958b9d32d5a2084a635e779
ppc64le mod_proxy_html-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.ppc64le.rpm b7e08b4e9f8667440835deccc56a9d3e50e0520b0e4eaa2ae6aafdbd86d2be23
ppc64le mod_ssl-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.ppc64le.rpm d18e8a45217a916a35cdc6a043b4c56e6cdeafe67965cae4c057bb17919720a4
ppc64le mod_md-2.0.8-8.module_el8.10.0+4295+280de5aa.4.ppc64le.rpm e141408bfeac464b1aee9d9102201d880ebb4b6ecd4d34974b5da2a33cba614d
ppc64le httpd-tools-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.ppc64le.rpm e508d9ad4cac3fc9b662603d717829b73bee32aa33c7be068e5777ce6d2be5f1
s390x mod_session-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.s390x.rpm 1722bddb16e6d88b0a77ce4ddb146a6b636732d10414c0da0cd77f3c2aead264
s390x httpd-devel-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.s390x.rpm 25f9bf40c61deb0d4b1b0c32286a1d4024f839e5463badfc6db1d07056049584
s390x mod_ssl-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.s390x.rpm 63acdaca143190b3de2a54639c047121d24ae2f243399f1795b5c33fc8933287
s390x mod_proxy_html-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.s390x.rpm 67705d3f01062238950a5fd987fe2addccce3a50a88db7b5099ba72cecb90d9d
s390x mod_md-2.0.8-8.module_el8.10.0+4295+280de5aa.4.s390x.rpm 77213e0dc5d6e283105de0558735e72ccb9323e86e22e31c675c95cd440f52c6
s390x httpd-tools-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.s390x.rpm 931500cb75a7104c954d79d25a3006455d020c1b12f1c370efd4e27bf3cc122d
s390x mod_ldap-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.s390x.rpm e0f1199802c367e057df9baa1f1c95c5c88df3da6495a034672fd8b2bd291df0
s390x httpd-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.s390x.rpm f3867806a3f07b3c3a75a202d9cd418be9b7e4e2cd0dd89ac54a75f7a58cfdd6
s390x mod_http2-1.15.7-10.module_el8.10.0+4233+8b7d9181.7.s390x.rpm ff47e1fb2a585ec374a56215d22828192bddf16403b007260955c8e1649e8fdb
x86_64 mod_ssl-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.x86_64.rpm 3812dd3824dbcfac73021d60fcc6bcd1754f1be64ee004f2e7d51842f67ee223
x86_64 httpd-devel-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.x86_64.rpm 45c5a67a03f99517c1db4a999543f0decba622c79fb250e72b671cb7938db991
x86_64 mod_http2-1.15.7-10.module_el8.10.0+4233+8b7d9181.7.x86_64.rpm 4beca8f6509a21445730a1fcf074335d374eaf3f5dcd6d6152c2bcd0c9f6d9fd
x86_64 httpd-tools-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.x86_64.rpm 62a4c18416be8f6253f6ee190b267b1f693c4c03eeec69426f42e68dab702b71
x86_64 mod_md-2.0.8-8.module_el8.10.0+4295+280de5aa.4.x86_64.rpm 711b8cbebfa7efd082aa86db82175145c2edaf4700e6a283e1b6e53733dc74e6
x86_64 httpd-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.x86_64.rpm 7d4c58cd1829094b7b2ebb6813128ee1acae17642b238b00e2cc3d94d25d8dbe
x86_64 mod_session-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.x86_64.rpm 812179577818447795c6c9473f155a8c788c6f0feeb164504fea224b8d42e0f0
x86_64 mod_proxy_html-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.x86_64.rpm 8b60718cc5267999730ee0126e297e08c85895fded6ce5f1c49fa7bfc74cd32b
x86_64 mod_ldap-2.4.37-65.module_el8.10.0+4332+2bef2e0d.13.x86_64.rpm f49188aa4cf7b502ebc6fd3b3d04a3ea57c336d4bc06126c4a7063533d432d47
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.