Critical Security Update for Apache HTTP Server (httpd): Addressing Multiple Vulnerabilities
Summary
ALSA-2026:22140: Important: httpd:2.4 security update. Affects httpd versions < 2.4.37-65.module_el8.10.0+4185+0955a0d7.8. Fixed in 2.4.37-65.module_el8.10.0+4185+0955a0d7.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely used open-source web server that provides a robust platform for hosting websites and applications. It is known for its flexibility, performance, and extensive feature set, including support for various protocols and modules. However, recent vulnerabilities have been identified that could potentially compromise the security of systems running this software, necessitating immediate attention and updates.
Vulnerability Detail
The vulnerabilities identified in the Apache HTTP Server include a range of issues such as a denial of service (DoS) due to memory increase (CVE-2025-53020), heap-based buffer over-reads and memory disclosures in mod_proxy_ajp (CVE-2026-34059, CVE-2026-34032), off-by-one out-of-bounds reads (CVE-2026-33857), and a NULL pointer dereference in mod_authn_socache that can lead to child process crashes (CVE-2026-33007). Additionally, there is a critical vulnerability that allows arbitrary code execution via heap-based buffer overflow in mod_proxy_ajp (CVE-2026-28780). These vulnerabilities could lead to severe security breaches, including unauthorized access and service disruptions.
How To Fix
Minimum fixed version
2.4.37-65.module_el8.10.0+4185+0955a0d7.8
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected modules until the patch can be applied. This can be done by commenting out the relevant LoadModule directives in the httpd configuration files. However, this is not a permanent solution and should only be used until the update is completed.
Conclusion
The recent vulnerabilities in the Apache HTTP Server pose significant risks to web applications and services. It is essential for users to update their installations promptly to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for httpd →
FAQ
The vulnerabilities can lead to denial of service, memory disclosures, and arbitrary code execution, which may compromise the security of the server and its data.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If immediate updates are not possible, consider disabling the affected modules as a temporary workaround until the patches can be applied.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to compromise server integrity.
Detailed information can be found on the CVE pages linked in the advisory, which provide insights into the vulnerabilities and their implications.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
