Critical Vulnerability in Apache HTTP Server (httpd): Multiple Buffer Overflows and Memory Issues
Summary
RLSA-2026:21391: Important: httpd security update. Affects httpd versions < 0:2.4.62-13.el9_8.1. Fixed in 0:2.4.62-13.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely used open-source web server known for its performance, flexibility, and extensibility. It serves as a foundation for many web applications and is integral to the functioning of the internet. However, recent vulnerabilities have been identified in its mod_proxy_ajp and mod_authn_socache modules, which can lead to severe security risks, including arbitrary code execution and memory disclosure.
Vulnerability Detail
The vulnerabilities stem from several issues within the Apache HTTP Server's modules. Specifically, mod_proxy_ajp is affected by heap-based buffer over-reads and an off-by-one error that can lead to out-of-bounds reads. Additionally, a NULL pointer dereference in mod_authn_socache can cause child process crashes. These vulnerabilities can be exploited to execute arbitrary code, leading to potential system compromise and data breaches.
How To Fix
Minimum fixed version
0:2.4.62-13.el9_8.1
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the affected modules (mod_proxy_ajp and mod_authn_socache) until the package is updated. This can be done by commenting out the relevant lines in your Apache configuration files.
Conclusion
The vulnerabilities identified in the Apache HTTP Server (httpd) pose significant risks to web applications. It is crucial to update to the latest patched version to safeguard against potential exploits. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for httpd →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
Exploitation of this vulnerability can lead to arbitrary code execution, memory disclosure, and crashes of the Apache server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, consider disabling the affected modules as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
