ALSA-2026:92616

    Dashboard / Vulnerabilities / ALSA-2026:92616

    ALSA-2026:92616

    Published: 29 Oct 2026Last Modified: 30 Oct 2026

    Summary: Important: httpd:2.4 security, bug fix, and enhancement update

    Details: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006) * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636) * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686) * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005) * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154) * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153) Bug Fix(es) and Enhancement(s): * mod_proxy_hcheck: passing health check does not recover worker from its standard error state (PROXY_WORKER_IN_ERROR) (JIRA:RHEL-256797) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    References: https://access.redhat.com/errata/RHSA-2026:92616, https://access.redhat.com/security/cve/CVE-2026-33006, https://access.redhat.com/security/cve/CVE-2026-46729, https://access.redhat.com/security/cve/CVE-2026-48005, https://access.redhat.com/security/cve/CVE-2026-56153, https://access.redhat.com/security/cve/CVE-2026-56154, https://access.redhat.com/security/cve/CVE-2026-63045, https://access.redhat.com/security/cve/CVE-2026-63292, https://access.redhat.com/security/cve/CVE-2026-63686, https://access.redhat.com/security/cve/CVE-2026-63718, https://access.redhat.com/security/cve/CVE-2026-73636, https://access.redhat.com/security/cve/CVE-2026-73637, https://access.redhat.com/security/cve/CVE-2026-93546, https://bugzilla.redhat.com/2465293, https://bugzilla.redhat.com/2544781, https://bugzilla.redhat.com/2544798, https://bugzilla.redhat.com/2544814, https://bugzilla.redhat.com/2544823, https://bugzilla.redhat.com/2544832, https://bugzilla.redhat.com/2544835, https://bugzilla.redhat.com/2544849, https://bugzilla.redhat.com/2544852, https://bugzilla.redhat.com/2544861, https://bugzilla.redhat.com/2544869, https://bugzilla.redhat.com/2544885, https://errata.almalinux.org/8/ALSA-2026-92616.html

    Affected packages

    Package

    Name: httpd

    Purl: pkg:rpm/almalinux/httpd

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.4.37-65.module_el8.10.0+4332+2bef2e0d.13

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    ALSA-2026:92616 | CVE-DB