p PatchFirst

ALSA-2026:41906

ALSA-2026:41906 · Important: httpd security, bug fix, and enhancement update

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072) * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) * httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) * httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges (CVE-2026-44119) Bug Fix(es) and Enhancement(s): * address Moderate severity issues from httpd 2.4.68 [almalinux-9.8.z] (JIRA:AlmaLinux-184520) * mod_proxy_html regression in CVE-2026-34355 fix [almalinux-9.8.z] (JIRA:AlmaLinux-192752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fix available

Published
Updated

Stack: system

Affected products and versions

  • httpd AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • httpd-core AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • httpd-devel AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • httpd-filesystem AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • httpd-manual AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • httpd-tools AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • mod_ldap AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • mod_lua AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • mod_proxy_html AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 1:2.4.62-13.el9_8.5

    Update to 1:2.4.62-13.el9_8.5

  • mod_session AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 2.4.62-13.el9_8.5

    Update to 2.4.62-13.el9_8.5

  • mod_ssl AlmaLinux:9

    Affected ranges
    • ECOSYSTEM: < 1:2.4.62-13.el9_8.5

    Update to 1:2.4.62-13.el9_8.5

Original sources

Check your server →