Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache HTTP Server can crash or be hijacked via LDAP
published 1 month ago
Summary
The Apache web server packages for AlmaLinux (httpd and related tools) contain a flaw in the LDAP module that could let an attacker run their own code or cause the server to stop working. This could lead to website downtime or compromise of data. Install the latest security update for the httpd packages as soon as possible to protect your servers.
What to do
- Update almalinux httpd to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux httpd-devel to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux httpd-filesystem to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux httpd-manual to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux httpd-tools to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux mod_http2 to version 1.15.7-10.module_el8.10.0+4233+8b7d9181.7.
- Update almalinux mod_ldap to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux mod_md to version 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2.
- Update almalinux mod_proxy_html to version 1:2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux mod_session to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
- Update almalinux mod_ssl to version 1:2.4.37-65.module_el8.10.0+4270+e5f13fdb.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | httpd |
< 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | httpd-devel |
< 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | httpd-filesystem |
< 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | httpd-manual |
< 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | httpd-tools |
< 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | mod_http2 |
< 1.15.7-10.module_el8.10.0+4233+8b7d9181.7 Fix: upgrade to 1.15.7-10.module_el8.10.0+4233+8b7d9181.7
|
| AlmaLinux:8 | almalinux | mod_ldap |
< 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | mod_md |
< 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 Fix: upgrade to 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2
|
| AlmaLinux:8 | almalinux | mod_proxy_html |
< 1:2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 1:2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | mod_session |
< 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
| AlmaLinux:8 | almalinux | mod_ssl |
< 1:2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 Fix: upgrade to 1:2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
|
Original advisory text
Low: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:64794 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-29167 Third Party Advisory
- https://bugzilla.redhat.com/2486394 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-64794.html Vendor Advisory
Timeline
Published8 Sep 2026
Updated30 Sep 2026
First seen30 Sep 2026
Sources
ALSA-2026:64794 · OSV
Track software like this
Free during beta