ALSA-2026:41906

ALSA-2026:41906 · Important: httpd security, bug fix, and enhancement update

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072) * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) * httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) * httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges (CVE-2026-44119) Bug Fix(es) and Enhancement(s): * address Moderate severity issues from httpd 2.4.68 [almalinux-9.8.z] (JIRA:AlmaLinux-184520) * mod_proxy_html regression in CVE-2026-34355 fix [almalinux-9.8.z] (JIRA:AlmaLinux-192752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Corrección disponible

Publicación

2026-07-20T00:00:00Z

Actualización

2026-07-21T13:15:39.551731047Z

Pila tecnológica: system

Comprueba tu servidor →