[ALSA-2026:88229] Important: httpd security update
Type:
security
Severity:
important
Release date:
2026-10-22
Description:
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636) * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686) * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005) * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154) * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 httpd-tools-2.4.62-13.el9_8.9.aarch64.rpm 152134144548ddff731beb2d43d1eed33f95555509e773568f87e47f7624802a
aarch64 httpd-2.4.62-13.el9_8.9.aarch64.rpm 528a1dac2793d58eff7284ae32f80980a47f0e2d1d04e6b476d7f230470ec870
aarch64 mod_ldap-2.4.62-13.el9_8.9.aarch64.rpm 6b1bd5282a3d32d5953ee86d6d45531593a9eb6500496f7e74ab7f436d1e234b
aarch64 httpd-core-2.4.62-13.el9_8.9.aarch64.rpm 785d87f81729f61655a484af5d74d7fad6b82205638f3cb888d019fdfda49f7b
aarch64 mod_ssl-2.4.62-13.el9_8.9.aarch64.rpm 7a2acfd3b828b83bd533c224aea642bfbefe56f1dab6b1b2113af46a90c0ce0d
aarch64 mod_proxy_html-2.4.62-13.el9_8.9.aarch64.rpm 8dc64a8f43b5840aa24869e57abc7bbab85f20b148952afb94bcb83f0227ba1c
aarch64 httpd-devel-2.4.62-13.el9_8.9.aarch64.rpm 987fb5a8ade1781b66149030994f0a3705004a96cacda887d5300634c0f030aa
aarch64 mod_lua-2.4.62-13.el9_8.9.aarch64.rpm ab797cf47d7f9e955fbf23f9cf02f305ee9116ec7441d52c9c5a82112fc8414f
aarch64 mod_session-2.4.62-13.el9_8.9.aarch64.rpm cb66a94a24ac9e0fd311afd40b1003f503ae99f2d070ab1453f445dc31160954
noarch httpd-filesystem-2.4.62-13.el9_8.9.noarch.rpm 6a2429a79aae70004496618facb3c0b1e5199f6b38dcfbe069d946036e1d7b49
noarch httpd-manual-2.4.62-13.el9_8.9.noarch.rpm d77bff969acdff5b9ca5b1f6c0d5d8e4cfb8b9e79d2cc72c68a4ad00477f9669
ppc64le httpd-core-2.4.62-13.el9_8.9.ppc64le.rpm 06b7be86c3079382928d703ff22eb673283abd996a086a5df8981738a09e283e
ppc64le mod_session-2.4.62-13.el9_8.9.ppc64le.rpm 1f2158d6b8bc046df72d2acf4ff0a2795fc0dd0b3eeaca7f8cda5c03537c7025
ppc64le httpd-devel-2.4.62-13.el9_8.9.ppc64le.rpm 2da8cddf591b327fec87fc3004c738c7d834bd237fad1669f0e70da52451a60a
ppc64le mod_lua-2.4.62-13.el9_8.9.ppc64le.rpm 62c060b07574b7f7b9dc228a914b982266b44657a1629125e2e190e8a9e3eda2
ppc64le mod_proxy_html-2.4.62-13.el9_8.9.ppc64le.rpm 7cfa0704d651171fde87fb647d433f4e7915a63e284d89a0e4058e0b78be0a81
ppc64le httpd-2.4.62-13.el9_8.9.ppc64le.rpm 83cc42c7b851a081f5a01de1bac60b0363a4f611ce439231dc40c78dd5ac0959
ppc64le httpd-tools-2.4.62-13.el9_8.9.ppc64le.rpm 85210cd5a023f2ede1163d0bcfd04106e60238f473292705e24b14e387fcbf50
ppc64le mod_ldap-2.4.62-13.el9_8.9.ppc64le.rpm a9b52ccdc45b5829c6f2071027e3f671ad2619d4b570cedd0508bf79e3e97b93
ppc64le mod_ssl-2.4.62-13.el9_8.9.ppc64le.rpm bdd99debcf31e9d807bbc39c2597a4a5fada461f834a07948f32665dd1421427
s390x mod_ldap-2.4.62-13.el9_8.9.s390x.rpm 29ce8545ffdc6275ad3f6ff6acddf853ca809449775558e744b0a5747cf17190
s390x mod_lua-2.4.62-13.el9_8.9.s390x.rpm 328bc85b452065895b09b9eecf8391207d3068b268a1ac4b7587b332f52df195
s390x httpd-devel-2.4.62-13.el9_8.9.s390x.rpm 3670390c8ccf7d6b0635face84a16266fbbeb4ec6ac1ce4f766a1b736dbb9bba
s390x mod_ssl-2.4.62-13.el9_8.9.s390x.rpm 44b1c47884ca1877413a7b6d183452046cc14800e899209c8ef927136aadd4b7
s390x httpd-tools-2.4.62-13.el9_8.9.s390x.rpm 4de9dacf38507fdb9cbc3687adb68748eb07d5b6bfe1e4b4ab2a52db475cc19a
s390x mod_proxy_html-2.4.62-13.el9_8.9.s390x.rpm 6dda7e6317f836dda072e6a4d56eac70fe877f72635e5c10de00cdf58ba4effd
s390x mod_session-2.4.62-13.el9_8.9.s390x.rpm cc9e315e4c8dff6c189a8b4a1f6084ba1c9114ad3db9dfb51aa965dc6b888bf8
s390x httpd-2.4.62-13.el9_8.9.s390x.rpm e4003a21782a099e2c52e665aa1e3160ceb7c3a95b33183fbdddf8e32ea3b230
s390x httpd-core-2.4.62-13.el9_8.9.s390x.rpm fd9acec0494347ceda45b8f52bf25f804976d3e7b8a400ee22a2d90a101aa3f9
x86_64 httpd-devel-2.4.62-13.el9_8.9.x86_64.rpm 0c96ef41f4cdf6ae9133ba35e459b65ee684640d9ce2728955e83e74c58e5946
x86_64 mod_session-2.4.62-13.el9_8.9.x86_64.rpm 24737c1e7bda2a8da5ee3ff7def9c933bd005bd7884794b201efc5c64dec2220
x86_64 mod_ldap-2.4.62-13.el9_8.9.x86_64.rpm 2aa0a27d3802fc3068858ad52f2a92d71fe232cdebf6fcc9f0d060f7e93f6a8e
x86_64 httpd-tools-2.4.62-13.el9_8.9.x86_64.rpm 2e42cd1e54f8c9f17be3913300d9701304e6aa61fc41cc5aba6ceb91365362ed
x86_64 mod_ssl-2.4.62-13.el9_8.9.x86_64.rpm 4c55680931d3bfaf4969e0ceb9f01fff2447a14d6ffd90535331f7890df97ede
x86_64 mod_proxy_html-2.4.62-13.el9_8.9.x86_64.rpm 552ca3d5784d42419706f7a30332717a6116f6b3195aac5128a6964997d5b4c5
x86_64 httpd-2.4.62-13.el9_8.9.x86_64.rpm 76e173ce6f203af9a58e78f8cccfb1b42f52d63f3b320c40aed4fcbdab100966
x86_64 mod_lua-2.4.62-13.el9_8.9.x86_64.rpm 95aa804faeb8638c6ecd6e4e0959d275cdc2883d11d7bce9e42737926b79e9b7
x86_64 httpd-core-2.4.62-13.el9_8.9.x86_64.rpm dfba786cb41d06fa685b738a4dbcc08e81fe3ff5086fcf54fb936d0014dd2824
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.