Most recent entries from all

ALSA-2026:88229 — Important: httpd security update

Affected: AlmaLinux:9: httpd, AlmaLinux:9: httpd-core, AlmaLinux:9: httpd-devel, AlmaLinux:9: httpd-filesystem, AlmaLinux:9: httpd-manual, AlmaLinux:9: httpd-tools, AlmaLinux:9: mod_ldap, AlmaLinux:9: mod_lua, AlmaLinux:9: mod_proxy_html, AlmaLinux:9: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636) * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686) * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005) * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154) * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BIT-apache-2026-46729 — Apache HTTP Server: mod_heartmonitor denial of service

Affected: Bitnami: apache

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

certfr-2026-avi-1248 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu…

certfr-2026-avi-1248

fkie_cve-2026-46729

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

GHSA-539q-64x2-q4mg

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

msrc_CVE-2026-46729 — Apache HTTP Server: mod_heartmonitor denial of service

msrc_CVE-2026-46729

OESA-2026-4364 — httpd security update

Affected: openEuler:24.03-LTS-SP3: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es):

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.

Users are recommended to upgrade to version 2.4.69, which fixes this issue(CVE-2026-42528)

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-46729)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.

When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.(CVE-2026-47360)

RHSA-2026:74858 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

httpd: httpd: arbitrary code execution via incorrect handler assignment during internal CGI redirects httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference httpd: httpd: Information disclosure via session cookie leakage during internal redirects httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite httpd: httpd: Denial of Service via mod_rewrite lookahead httpd: httpd: Denial of Service via crafted HTTP response bodies in mod_proxy_html httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy httpd: httpd: Information disclosure via direct request to the WebDAV state directory httpd: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi httpd: httpd: Authentication bypass via credential replay in mod_auth_digest httpd: httpd: Authentication state corruption via concurrent Digest authentication requests httpd: httpd: Information disclosure in mod_userdir…

RHSA-2026:88229 — Red Hat Security Advisory: httpd security update

httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite httpd: httpd: Denial of Service via mod_rewrite lookahead httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi httpd: httpd: Authentication bypass via credential replay in mod_auth_digest httpd: httpd: Authentication state corruption via concurrent Digest authentication requests httpd: httpd: Denial of Service via integer overflow in mod_dav_fs

UBUNTU-CVE-2026-46729

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:Pro:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2, Ubuntu:26.10: apache2, Ubuntu:26.04:LTS: apache2

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.