RHSA-2026:89860
Vulnerability from csaf_redhat - Published: 2026-10-26 10:06 - Updated: 2026-11-05 21:17Summary
Red Hat Security Advisory: httpd security update
Severity
Important
Notes
Topic: An update for httpd is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718)
* httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546)
* httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637)
* httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)
* httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292)
* httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729)
* httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636)
* httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686)
* httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005)
* httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154)
* httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the mod_heartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attacker can crash the server process, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
75 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) condition by disrupting valid sessions and repeatedly forcing legitimate users to re-authenticate.
CWE-303 - Incorrect Implementation of Authentication AlgorithmAffected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Low
A flaw was found in httpd's mod_charset_lite module. A heap-based buffer overflow (an out-of-bounds memory write) occurs in the finish_partial_char function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory corruption. This issue primarily results in a Denial of Service (DoS) condition by crashing the server process.
7.5 (High)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Important
A use-after-free flaw was found in the mod_rewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %{LA-U:HTTP:...}. A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration, potentially causing a denial of service or arbitrary code execution.
8.1 (High)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Important
A flaw was found in httpd. When configured as a forward proxy using the mod_proxy_ftp module, the server improperly validates the network address returned in a File Transfer Protocol (FTP) passive mode (PASV) response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing the proxy to establish a data connection to an arbitrary third-party host. This issue may allow an attacker to initiate unauthorized network connections or probe internal systems that are otherwise inaccessible.
5.3 (Medium)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Moderate
A flaw was found in httpd's mod_vhost_alias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the web server.
8.1 (High)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Important
A flaw was found in the mod_xml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service (DoS) by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access (null pointer dereference), causing the server process to crash.
7.5 (High)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Important
A flaw was found in the mod_proxy_uwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentially leading to response tampering or cache poisoning for other users.
7.5 (High)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Important
A flaw was found in the mod_auth_digest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce (a single-use security token) lifetime of zero, an attacker can send crafted requests that prematurely clear the client session entry from shared memory, enabling unauthorized access using the replayed credentials.
8.1 (High)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Important
A flaw was found in httpd's mod_auth_digest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce checking (AuthDigestNcCheck) or zero-duration nonce lifetimes (AuthDigestNonceLifetime), are enabled.
5.6 (Medium)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Moderate
A flaw was found in httpd. An integer overflow in the mod_dav_fs module occurs when processing Web Distributed Authoring and Versioning (WebDAV) PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash server worker processes, causing a Denial of Service (DoS), and persistently corrupt the directory's property database.
5.4 (Medium)
Affected products
Fixed
75 products, the same list as for
CVE-2026-46729
Threats
Impact
Moderate
References
70 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for httpd is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.\n\nSecurity Fix(es):\n\n* httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718)\n\n* httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546)\n\n* httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637)\n\n* httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)\n\n* httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292)\n\n* httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729)\n\n* httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636)\n\n* httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686)\n\n* httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005)\n\n* httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154)\n\n* httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:89860",
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2544781",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544781"
},
{
"category": "external",
"summary": "2544798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544798"
},
{
"category": "external",
"summary": "2544814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544814"
},
{
"category": "external",
"summary": "2544823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544823"
},
{
"category": "external",
"summary": "2544832",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544832"
},
{
"category": "external",
"summary": "2544835",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544835"
},
{
"category": "external",
"summary": "2544849",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544849"
},
{
"category": "external",
"summary": "2544852",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544852"
},
{
"category": "external",
"summary": "2544861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544861"
},
{
"category": "external",
"summary": "2544869",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544869"
},
{
"category": "external",
"summary": "2544885",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544885"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89860.json"
}
],
"title": "Red Hat Security Advisory: httpd security update",
"tracking": {
"current_release_date": "2026-11-05T21:17:21+00:00",
"generator": {
"date": "2026-11-05T21:17:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:89860",
"initial_release_date": "2026-10-26T10:06:54+00:00",
"revision_history": [
{
"date": "2026-10-26T10:06:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-26T10:06:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-05T21:17:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-0:2.4.63-13.el10_2.8.src",
"product": {
"name": "httpd-0:2.4.63-13.el10_2.8.src",
"product_id": "httpd-0:2.4.63-13.el10_2.8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.4.63-13.el10_2.8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html@2.4.63-13.el10_2.8?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_session-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_session-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.4.63-13.el10_2.8?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debugsource@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.63-13.el10_2.8?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.63-13.el10_2.8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"product": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"product_id": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.63-13.el10_2.8?arch=aarch64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html@2.4.63-13.el10_2.8?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.4.63-13.el10_2.8?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debugsource@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"product": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"product_id": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.63-13.el10_2.8?arch=ppc64le\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html@2.4.63-13.el10_2.8?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.4.63-13.el10_2.8?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debugsource@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.63-13.el10_2.8?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.63-13.el10_2.8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"product": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"product_id": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.63-13.el10_2.8?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "httpd-core-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-core-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_lua-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_lua-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html@2.4.63-13.el10_2.8?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_session-0:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_session-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.4.63-13.el10_2.8?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debugsource@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_id": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.63-13.el10_2.8?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.63-13.el10_2.8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"product": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"product_id": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.63-13.el10_2.8?arch=s390x\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"product": {
"name": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"product_id": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-filesystem@2.4.63-13.el10_2.8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"product": {
"name": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"product_id": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-manual@2.4.63-13.el10_2.8?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.4.63-13.el10_2.8.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src"
},
"product_reference": "httpd-0:2.4.63-13.el10_2.8.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-core-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch"
},
"product_reference": "httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-manual-0:2.4.63-13.el10_2.8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch"
},
"product_reference": "httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_lua-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_session-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_session-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_session-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64"
},
"product_reference": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le"
},
"product_reference": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x"
},
"product_reference": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
},
"product_reference": "mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-46729",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-01T23:07:14.331403+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544835"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the mod_heartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attacker can crash the server process, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this flaw as having an Important severity because unauthenticated network clients can crash the HTTP server process without user interaction, causing a complete denial of service. Under standard installations across Red Hat Enterprise Linux, mod_heartmonitor is not enabled by default and requires administrators to explicitly load the module and configure a unicast listener. Systems that do not use mod_heartmonitor or do not expose its listener to untrusted networks are not vulnerable to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46729"
},
{
"category": "external",
"summary": "RHBZ#2544835",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544835"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46729",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46729"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/13",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/13"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T15:55:27.083000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "Disable the mod_heartmonitor module or restrict network access to the monitoring port:\n\n1. Disable the module:\nComment out the LoadModule directive for mod_heartmonitor in the Apache configuration (typically located in `/etc/httpd/conf.modules.d/00-base.conf` or a custom configuration file):\n# LoadModule heartmonitor_module modules/mod_heartmonitor.so\n\nThen reload the web server configuration:\nsystemctl reload httpd\n\n2. Restrict network reachability:\nIf mod_heartmonitor is required, configure firewall rules using firewalld to permit traffic to the HeartbeatListen unicast port only from authorized backend nodes:\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_RANGE\u003e\nfirewall-cmd --reload\n\nCaveat: Disabling mod_heartmonitor prevents mod_lbmethod_heartbeat from receiving backend node status, which disables heartbeat-based dynamic load balancing.\n\nWarning: Modifying Apache configuration files requires reloading or restarting httpd, which may briefly interrupt active network connections.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference"
},
{
"cve": "CVE-2026-48005",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-10-01T23:10:15.030167+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544861"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) condition by disrupting valid sessions and repeatedly forcing legitimate users to re-authenticate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48005"
},
{
"category": "external",
"summary": "RHBZ#2544861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48005"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/15",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/15"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:01:35.559000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable nonce-count verification by setting `AuthDigestNcCheck Off` within the relevant configuration context in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`:\n\nAuthDigestNcCheck Off\n\nAlternatively, if Digest authentication is not required, disable `mod_auth_digest` by commenting out the corresponding `LoadModule auth_digest_module` line in `/etc/httpd/conf.modules.d/00-base.conf`.\n\nAfter modifying the configuration, reload the service:\n\nsystemctl reload httpd\n\nCaveats: Disabling `AuthDigestNcCheck` removes server-side nonce-count checking, reducing replay protection for Digest authentication.\n\nWarning: Reloading the httpd service can momentarily disrupt in-flight connections.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest"
},
{
"cve": "CVE-2026-56153",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-01T23:12:13.148592+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544885"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in httpd\u0027s mod_charset_lite module. A heap-based buffer overflow (an out-of-bounds memory write) occurs in the finish_partial_char function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory corruption. This issue primarily results in a Denial of Service (DoS) condition by crashing the server process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important impact for Red Hat products because an unauthenticated remote attacker can trigger memory corruption across the network, resulting in worker termination and service denial. The flaw specifically targets environments where character set translation features are enabled within the web server. Deployments that do not actively load or configure the `mod_charset_lite` module are not susceptible to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56153"
},
{
"category": "external",
"summary": "RHBZ#2544885",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544885"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56153"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/16",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/16"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:03:25.568000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "Disable the mod_charset_lite module if character set translation is not required.\n\n1. Locate the configuration file loading the module, typically within `/etc/httpd/conf.modules.d/` (such as `00-base.conf` or a dedicated module configuration file).\n2. Comment out or remove the `LoadModule charset_lite_module` line:\n```\n# LoadModule charset_lite_module modules/mod_charset_lite.so\n```\n3. Reload the httpd service to apply the configuration change:\n```\nsystemctl reload httpd\n```\n\nCaveats: Applications that depend on mod_charset_lite for on-the-fly character set conversion will fail to translate character sets once the module is disabled.\n\nWarning: Reloading or restarting the httpd service will momentarily disrupt active network connections or in-flight requests.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite"
},
{
"cve": "CVE-2026-56154",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-10-01T23:11:02.380013+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544869"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the mod_rewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %{LA-U:HTTP:...}. A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration, potentially causing a denial of service or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Denial of Service via mod_rewrite lookahead",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat initially assesses this issue as Important due to the potential for remote denial of service or code execution in affected mod_rewrite configurations. Exploitation requires URL lookahead expressions that reference HTTP request headers, such as %{LA-U:HTTP:...}. Product-specific impact and exploitation conditions remain under review with Engineering.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56154"
},
{
"category": "external",
"summary": "RHBZ#2544869",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544869"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56154"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/17",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/17"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:03:52.280000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "Review the effective Apache HTTP Server configuration, including virtual host configurations and .htaccess files, for affected HTTP-header lookahead expressions such as %{LA-U:HTTP:...}. Remove or replace these expressions where application requirements permit.\nAlternatively, disable mod_rewrite if the application does not require it. These changes may affect URL rewriting and application routing. Validate the configuration and reload or restart the service as appropriate.\nApply a vendor-supported security update containing the fix when available.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: httpd: Denial of Service via mod_rewrite lookahead"
},
{
"cve": "CVE-2026-63045",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery"
},
"discovery_date": "2026-10-01T23:05:56.978362+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544823"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in httpd. When configured as a forward proxy using the mod_proxy_ftp module, the server improperly validates the network address returned in a File Transfer Protocol (FTP) passive mode (PASV) response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing the proxy to establish a data connection to an arbitrary third-party host. This issue may allow an attacker to initiate unauthorized network connections or probe internal systems that are otherwise inaccessible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63045"
},
{
"category": "external",
"summary": "RHBZ#2544823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544823"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63045"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63045",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63045"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/23",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/23"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:09:07.643000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "Disable the mod_proxy_ftp module or ensure forward proxying is disabled in the Apache HTTP Server configuration.\n\n1. Comment out the mod_proxy_ftp module load line in `/etc/httpd/conf.modules.d/00-proxy.conf`:\n```\n# LoadModule proxy_ftp_module modules/mod_proxy_ftp.so\n```\n\n2. Ensure forward proxying is turned off in `/etc/httpd/conf/httpd.conf`:\n```\nProxyRequests Off\n```\n\n3. Reload the httpd service to apply changes:\n```\nsystemctl reload httpd\n```\n\nCaveat: Disabling mod_proxy_ftp terminates the ability of httpd to proxy FTP requests.\nWarning: Reloading or restarting the httpd service will briefly affect active connections while configuration changes are reloaded.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response"
},
{
"cve": "CVE-2026-63292",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-01T23:06:53.740525+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544832"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in httpd\u0027s mod_vhost_alias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the web server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker could cause memory corruption resulting in arbitrary code execution or server crashes under specific virtual host configurations. Exploitation requires non-default settings: the server must have `mod_vhost_alias` enabled with a hostname format specifier in `VirtualDocumentRoot`, and `LimitRequestFieldSize` must be explicitly raised beyond its default threshold of 8192 bytes. Typical Red Hat Enterprise Linux deployments retain the default header limit, which causes the core server to reject oversized Host headers before they reach the virtual host alias handler.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63292"
},
{
"category": "external",
"summary": "RHBZ#2544832",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544832"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63292"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/24",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/24"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:11:47.911000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability without code modifications, ensure that `LimitRequestFieldSize` remains at or below its default limit of 8190 bytes, or disable the `mod_vhost_alias` module if dynamic virtual hosting is not required.\n\n1. Ensure `LimitRequestFieldSize` is not configured above 8190 in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`:\n```\nLimitRequestFieldSize 8190\n```\n\n2. Alternatively, if `mod_vhost_alias` is not needed, disable it by commenting out its loading directive in `/etc/httpd/conf.modules.d/00-base.conf`:\n```\n# LoadModule vhost_alias_module modules/mod_vhost_alias.so\n```\n\n3. Validate the configuration syntax and reload the service:\n```\napachectl configtest\nsystemctl reload httpd\n```\n\nCaveats: Restricting `LimitRequestFieldSize` may reject legitimate requests that carry exceptionally large HTTP headers, returning a 400 Bad Request response. Disabling `mod_vhost_alias` prevents the use of dynamic virtual host directives such as `VirtualDocumentRoot`.\n\nWarning: Reloading or restarting the `httpd` daemon may briefly affect in-flight network connections.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias"
},
{
"cve": "CVE-2026-63686",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-01T23:09:03.782806+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544852"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the mod_xml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service (DoS) by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access (null pointer dereference), causing the server process to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as Important severity because an untrusted upstream system can remotely terminate the web server worker process, creating a denial of service across active client connections without requiring host privileges. The risk is primarily present in reverse-proxy architectures where mod_xml2enc is actively filtering and transcoding HTTP responses. Typical web server configurations that do not forward requests through this module or that only interface with trusted internal origin servers face significantly reduced operational exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63686"
},
{
"category": "external",
"summary": "RHBZ#2544852",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544852"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63686"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63686",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63686"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/25",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/25"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:20:14.360000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "If proxy character set transcoding is not required, disable the mod_xml2enc module by commenting out its configuration directive.\n\n1. Edit the module configuration file (typically located under `/etc/httpd/conf.modules.d/`) and comment out the loading directive:\n # LoadModule xml2enc_module modules/mod_xml2enc.so\n\n2. Verify the configuration syntax:\n httpd -t\n\n3. Reload the Apache HTTP Server to apply changes:\n systemctl reload httpd\n\nCaveats: Disabling mod_xml2enc will break modules that depend on XML or HTML character set conversion, such as mod_proxy_html. If this module is required, restrict proxy rules so httpd communicates only with trusted upstream backends.\n\nWarning: Reloading or restarting the httpd service may cause a brief interruption to active connections.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc"
},
{
"cve": "CVE-2026-63718",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-10-01T22:29:59.448690+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544781"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the mod_proxy_uwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentially leading to response tampering or cache poisoning for other users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw with an Important severity because unauthenticated remote attackers can manipulate HTTP stream boundaries to poison web caches or tamper with downstream client responses. Impact is limited to environments where Apache HTTP Server actively handles traffic via the mod_proxy_uwsgi module to backend services. Systems that do not proxy requests to uWSGI endpoints remain unexposed to this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63718"
},
{
"category": "external",
"summary": "RHBZ#2544781",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544781"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63718"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/26",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/26"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:17:06.585000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "If uWSGI proxy functionality is not required, disable the mod_proxy_uwsgi module:\n\n1. Edit the Apache proxy module configuration file (typically `/etc/httpd/conf.modules.d/00-proxy.conf`) and comment out the loading directive:\n # LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so\n\n2. Restart the Apache HTTP Server daemon:\n systemctl restart httpd\n\nWarning: Restarting the httpd service causes an immediate disruption to active client connections. Disabling this module will prevent the server from handling requests routed through the uWSGI protocol.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi"
},
{
"cve": "CVE-2026-73636",
"cwe": {
"id": "CWE-294",
"name": "Authentication Bypass by Capture-replay"
},
"discovery_date": "2026-10-01T23:08:47.276061+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544849"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the mod_auth_digest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce (a single-use security token) lifetime of zero, an attacker can send crafted requests that prematurely clear the client session entry from shared memory, enabling unauthorized access using the replayed credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Authentication bypass via credential replay in mod_auth_digest",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an attacker capable of eavesdropping on network traffic can replay captured credentials to bypass access controls, leading to a complete compromise of protected resources. Exploitation depends on an explicit, non-default configuration where the AuthDigestNonceLifetime directive is configured to zero, inducing shared-memory session eviction. Red Hat Enterprise Linux does not configure or enable digest authentication by default, significantly reducing out-of-the-box exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73636"
},
{
"category": "external",
"summary": "RHBZ#2544849",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544849"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73636"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/27",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/27"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:17:59.618000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "Ensure that `AuthDigestNonceLifetime` is not set to `0`. If digest authentication is not required, disable `mod_auth_digest`.\n\n1. To retain digest authentication with safe settings, set a positive non-zero value (such as the default 300 seconds) or remove the explicit zero setting from `/etc/httpd/conf/httpd.conf` or relevant files in `/etc/httpd/conf.d/`:\n```\nAuthDigestNonceLifetime 300\n```\n\n2. If HTTP digest authentication is not needed, disable the module by commenting out the corresponding line in `/etc/httpd/conf.modules.d/00-base.conf`:\n```\n#LoadModule auth_digest_module modules/mod_auth_digest.so\n```\n\n3. Restart the web server to apply changes:\n```\nsystemctl restart httpd\n```\n\nWarning: Restarting or reloading the httpd service will briefly disrupt active client connections. Disabling the module will break authentication for virtual hosts or directories relying on digest authentication.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: httpd: Authentication bypass via credential replay in mod_auth_digest"
},
{
"cve": "CVE-2026-73637",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-10-01T23:01:30.310347+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544814"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in httpd\u0027s mod_auth_digest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server\u0027s authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce checking (AuthDigestNcCheck) or zero-duration nonce lifetimes (AuthDigestNonceLifetime), are enabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Authentication state corruption via concurrent Digest authentication requests",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73637"
},
{
"category": "external",
"summary": "RHBZ#2544814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73637"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73637",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73637"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/28",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/28"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:18:30.190000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "To mitigate this issue, apply one of the following configuration options:\n\n1. Disable `mod_auth_digest` if Digest authentication is not required:\nIn `/etc/httpd/conf.modules.d/00-base.conf` (or the relevant module configuration file), comment out the loading of the module:\n```\n# LoadModule auth_digest_module modules/mod_auth_digest.so\n```\n\n2. If Digest authentication is required, ensure vulnerable settings are disabled:\nEnsure `AuthDigestNcCheck` is set to `Off` (or removed, as `Off` is the default) and ensure `AuthDigestNonceLifetime` is not set to `0` (the default value is 300 seconds).\n\nAfter applying configuration adjustments, reload the web server:\n```\nsystemctl reload httpd\n```\n\nWarning: Reloading or restarting the `httpd` service may briefly disrupt active client connections. Disabling `mod_auth_digest` will cause authentication failures for resources configured with `AuthType Digest`.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: httpd: Authentication state corruption via concurrent Digest authentication requests"
},
{
"cve": "CVE-2026-93546",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-10-01T22:44:48.492068+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544798"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in httpd. An integer overflow in the mod_dav_fs module occurs when processing Web Distributed Authoring and Versioning (WebDAV) PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash server worker processes, causing a Denial of Service (DoS), and persistently corrupt the directory\u0027s property database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: httpd: Denial of Service via integer overflow in mod_dav_fs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93546"
},
{
"category": "external",
"summary": "RHBZ#2544798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544798"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93546"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93546",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93546"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/10/01/30",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/30"
},
{
"category": "external",
"summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2026-10-01T16:19:32.662000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-26T10:06:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89860"
},
{
"category": "workaround",
"details": "If WebDAV capabilities are not required, disable the `mod_dav_fs` module:\n\n1. Comment out the `dav_fs_module` directive in `/etc/httpd/conf.modules.d/00-dav.conf`:\n```\n#LoadModule dav_fs_module modules/mod_dav_fs.so\n```\n\nAlternatively, if WebDAV is required but property modifications can be restricted, block the `PROPPATCH` method in the affected `\u003cDirectory\u003e` or `\u003cLocation\u003e` configuration block:\n```apache\n\u003cLocation \"/webdav\"\u003e\n \u003cLimit PROPPATCH\u003e\n Require all denied\n \u003c/Limit\u003e\n\u003c/Location\u003e\n```\n\n2. Apply the configuration changes:\n```\nsystemctl reload httpd\n```\n\nCaveats:\nDisabling `mod_dav_fs` disables file-backed WebDAV shares across the server. Blocking `PROPPATCH` prevents clients from manipulating WebDAV dead properties.\n\nWarning: Reloading or restarting the `httpd` service will temporarily impact active client connections.",
"product_ids": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.src",
"AppStream-10.2.Z:httpd-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-devel-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-filesystem-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-manual-0:2.4.63-13.el10_2.8.noarch",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:httpd-tools-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ldap-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_lua-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_session-debuginfo-0:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-1:2.4.63-13.el10_2.8.x86_64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.aarch64",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.ppc64le",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.s390x",
"AppStream-10.2.Z:mod_ssl-debuginfo-1:2.4.63-13.el10_2.8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: httpd: Denial of Service via integer overflow in mod_dav_fs"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.