RLSA-2026:88229: Important httpd security update for Rocky Linux 9
Summary
RLSA-2026:88229: Multiple security flaws can enable remote code execution, authentication bypass, unauthorized connections, HTTP response smuggling, and denial of service. Affects httpd versions < 0:2.4.62-13.el9_8.9. Fixed in 0:2.4.62-13.el9_8.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
httpd is a web server package in the Rocky Linux:9 ecosystem. It provides the Apache HTTP Server, described in the advisory as a powerful, efficient, and extensible web server. The package is used to serve web content and handle HTTP requests; the advisory identifies affected components including proxy, authentication, DAV, and other modules.
Vulnerability Detail
The flaws can allow arbitrary code execution, authentication bypass, unauthorized connections to arbitrary hosts, HTTP response smuggling, and denial of service. The advisory identifies issues in mod_vhost_alias, mod_auth_digest, mod_proxy_uwsgi, mod_dav_fs, mod_rewrite, mod_charset_lite, mod_xml2enc, and other components. The listed mechanics include crafted headers or responses, concurrent requests, integer overflow, and buffer overflow. The affected package is httpd in Rocky Linux:9.
How To Fix
Minimum fixed version
0:2.4.62-13.el9_8.9
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to the affected httpd service and disable modules identified in the advisory if they are not required. This reduces exposure but does not replace applying the minimum fixed version.
Conclusion
Upgrade to 2.4.62-13.el9_8.9, the minimum fixed version listed for Rocky Linux:9. The advisory covers multiple flaws across httpd modules, with impacts ranging from denial of service to arbitrary code execution. Apply the fixed version and review whether affected modules are enabled. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for httpd →
FAQ
The advisory marks httpd as affected from version 0 up to, but not including, 2.4.62-13.el9_8.9.
The httpd flaws can enable arbitrary code execution, authentication bypass, unauthorized connections, response smuggling, and denial of service.
The minimum fixed version for httpd on Rocky Linux:9 is 2.4.62-13.el9_8.9.
Restrict access to httpd and disable affected modules that are not required until the minimum fixed version can be applied.
Check the system's installed package records or deployment manifest for httpd. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
