Critical Vulnerability in httpd Package: Apache HTTP Server Buffer Overflows and Memory Disclosure
Summary
ALSA-2026:21433: Important: httpd security update. Affects httpd versions < 2.4.63-13.el10_2.1. Fixed in 2.4.63-13.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd package provides the Apache HTTP Server, a widely used web server known for its performance, flexibility, and extensibility. It supports various modules and configurations, making it a popular choice for hosting websites and applications. However, recent vulnerabilities have been identified in the mod_proxy_ajp module, which can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities in the httpd package stem from several issues in the mod_proxy_ajp module, including heap-based buffer over-reads, memory disclosure, and off-by-one out-of-bounds reads. These vulnerabilities can allow attackers to exploit the server, potentially leading to arbitrary code execution, child process crashes, and unauthorized access to sensitive data. The vulnerabilities are tracked under CVEs: CVE-2026-34059, CVE-2026-34032, CVE-2026-33857, CVE-2026-33007, and CVE-2026-28780.
How To Fix
Minimum fixed version
2.4.63-13.el10_2.1
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the mod_proxy_ajp module if it is not required for your application. This can be done by commenting out the relevant lines in the Apache configuration file (usually located at /etc/httpd/conf/httpd.conf) that load the module. For example: '#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so'. Restart the Apache server after making changes.
Conclusion
The vulnerabilities in the httpd package pose significant risks to server security, primarily through the mod_proxy_ajp module. It is crucial to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time, ensuring your applications remain secure.
See every vulnerability recorded for httpd →
FAQ
The vulnerabilities can lead to memory disclosure, crashes of child processes, and even arbitrary code execution, which can compromise the server's integrity and security.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can receive real-time alerts about vulnerabilities.
Disabling the mod_proxy_ajp module can serve as a temporary workaround until the package is updated.
The vulnerabilities are tracked under CVEs: CVE-2026-34059, CVE-2026-34032, CVE-2026-33857, CVE-2026-33007, and CVE-2026-28780.
It is recommended to check for updates regularly, ideally weekly or monthly, to ensure that all packages are secure and up-to-date.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
