Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
Red Hat Apache HTTP Server may allow remote code execution
published today
Summary
The Apache web server packages for Red Hat (httpd and related development and debug packages) contain a flaw that could let an attacker run code on the server from a distance. This could lead to loss of control over the web server and expose data. Apply the Red Hat security update for the httpd packages as soon as possible to close the gap.
What to do
- Update redhat httpd to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat httpd-debuginfo to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat httpd-debugsource to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat httpd-devel to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat httpd-filesystem to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat httpd-manual to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat httpd-tools to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat httpd-tools-debuginfo to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_http2 to version 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6.
- Update redhat mod_http2-debuginfo to version 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6.
- Update redhat mod_http2-debugsource to version 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6.
- Update redhat mod_ldap to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_ldap-debuginfo to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_md to version 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1.
- Update redhat mod_md-debuginfo to version 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1.
- Update redhat mod_md-debugsource to version 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1.
- Update redhat mod_proxy_html to version 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_proxy_html-debuginfo to version 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_session to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_session-debuginfo to version 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_ssl to version 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
- Update redhat mod_ssl-debuginfo to version 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd-debugsource |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd-devel |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd-filesystem |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd-manual |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd-tools |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | httpd-tools-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_http2 |
< 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6 Fix: upgrade to 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_http2-debuginfo |
< 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6 Fix: upgrade to 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_http2-debugsource |
< 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6 Fix: upgrade to 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_ldap |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_ldap-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_md |
< 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1 Fix: upgrade to 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_md-debuginfo |
< 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1 Fix: upgrade to 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_md-debugsource |
< 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1 Fix: upgrade to 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_proxy_html |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_proxy_html-debuginfo |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_session |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_session-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_ssl |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_aus:8.6::appstream | redhat | mod_ssl-debuginfo |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd-debugsource |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd-devel |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd-filesystem |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd-manual |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd-tools |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | httpd-tools-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_http2 |
< 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6 Fix: upgrade to 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_http2-debuginfo |
< 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6 Fix: upgrade to 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_http2-debugsource |
< 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6 Fix: upgrade to 0:1.15.7-5.module+el8.6.0+24684+a8b2cd6a.6
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_ldap |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_ldap-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_md |
< 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1 Fix: upgrade to 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_md-debuginfo |
< 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1 Fix: upgrade to 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_md-debugsource |
< 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1 Fix: upgrade to 1:2.0.8-8.module+el8.6.0+23843+c27a5dc4.1
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_proxy_html |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_proxy_html-debuginfo |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_session |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_session-debuginfo |
< 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 0:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_ssl |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
| Red Hat:rhel_eus_long_life:8.6::appstream | redhat | mod_ssl-debuginfo |
< 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14 Fix: upgrade to 1:2.4.37-47.module+el8.6.0+24684+a8b2cd6a.14
|
Original advisory text
Red Hat Security Advisory: httpd:2.4 security update
References
- https://access.redhat.com/errata/RHSA-2026:99514 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2374549 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2465296 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2486395 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2486397 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2486399 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2486402 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2486411 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2486414 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2486415 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99514.... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-42516 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-42516 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-42516 Vendor Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-29169 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-29169 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-29169 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-34355 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-34355 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34355 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-34356 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-34356 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34356 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-42536 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-42536 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42536 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-43951 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-43951 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-43951 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-44185 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44185 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44185 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-44186 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44186 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44186 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-44631 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44631 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44631 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published13 Nov 2026
Updated13 Nov 2026
First seen13 Nov 2026
Sources
RHSA-2026:99514 · OSV
Track software like this
Free during beta