Critical Vulnerabilities in Apache HTTP Server (httpd) - Important Security Update
Summary
ALSA-2026:41906: Important: httpd security, bug fix, and enhancement update. Affects httpd versions < 2.4.62-13.el9_8.5. Fixed in 2.4.62-13.el9_8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely used open-source web server software that provides a robust and efficient platform for serving web content. It is known for its flexibility, extensibility, and strong community support. However, recent vulnerabilities have been identified that could compromise the security of systems running this software, necessitating immediate attention and remediation.
Vulnerability Detail
The vulnerabilities in the Apache HTTP Server include an incomplete fix for CVE-2023-38709, privilege escalation via .htaccess file manipulation (CVE-2026-24072), timing attacks that allow bypassing of digest authentication (CVE-2026-33006), NULL pointer dereference via crafted requests (CVE-2026-29169), heap-based buffer overflow from malicious backend servers (CVE-2026-34356), and denial of service attacks via crafted regular expressions (CVE-2026-44631). These vulnerabilities can lead to unauthorized access, data breaches, and service disruptions, posing significant risks to affected systems.
How To Fix
Minimum fixed version
2.4.62-13.el9_8.5
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected modules or restricting access to sensitive directories until the update can be applied. This can be done by modifying the server configuration files to limit access permissions.
Conclusion
The recent vulnerabilities identified in the Apache HTTP Server pose significant risks to web applications. It is crucial for administrators to apply the necessary updates to safeguard their systems against potential exploits. Utilizing tools like Vulert can help in monitoring and managing these vulnerabilities effectively.
See every vulnerability recorded for httpd →
FAQ
The vulnerabilities can lead to unauthorized access, privilege escalation, denial of service, and potential data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
Yes, you can disable affected modules or restrict access to sensitive directories as a temporary measure.
If immediate updates are not possible, ensure to implement strict access controls and monitor your server for any suspicious activity.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
