RLSA-2026:34109

Synopsis

Important: httpd security, bug fix, and enhancement update

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)

* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)

* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

Bug Fix(es) and Enhancement(s):

* address Moderate severity issues from httpd 2.4.68 [rhel-10.2.z] (JIRA:Rocky Linux-184518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 10 aarch64 Rocky Linux 10 ppc64le Rocky Linux 10 riscv64 Rocky Linux 10 s390x Rocky Linux 10 x86_64

Fixes

2486411 2486397 2374549 2486399 2486395 2465296 2486414

CVEs

CVE-2024-42516 CVE-2026-29169 CVE-2026-34355 CVE-2026-34356 CVE-2026-42536 CVE-2026-44185 CVE-2026-44631

Affected packages

Rocky Linux 10 ppc64le - AppStream

mod_ssl-1:2.4.63-13.el10_2.4.ppc64le.rpm mod_lua-0:2.4.63-13.el10_2.4.ppc64le.rpm mod_lua-debuginfo-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-filesystem-0:2.4.63-13.el10_2.4.noarch.rpm httpd-core-debuginfo-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-devel-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-0:2.4.63-13.el10_2.4.src.rpm httpd-debugsource-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-tools-0:2.4.63-13.el10_2.4.ppc64le.rpm mod_ssl-debuginfo-1:2.4.63-13.el10_2.4.ppc64le.rpm mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.4.ppc64le.rpm mod_session-0:2.4.63-13.el10_2.4.ppc64le.rpm mod_session-debuginfo-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-manual-0:2.4.63-13.el10_2.4.noarch.rpm mod_proxy_html-1:2.4.63-13.el10_2.4.ppc64le.rpm mod_ldap-debuginfo-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-debuginfo-0:2.4.63-13.el10_2.4.ppc64le.rpm mod_ldap-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-tools-debuginfo-0:2.4.63-13.el10_2.4.ppc64le.rpm httpd-core-0:2.4.63-13.el10_2.4.ppc64le.rpm

Rocky Linux 10 x86_64 - AppStream

httpd-0:2.4.63-13.el10_2.4.x86_64.rpm httpd-core-debuginfo-0:2.4.63-13.el10_2.4.x86_64.rpm mod_lua-debuginfo-0:2.4.63-13.el10_2.4.x86_64.rpm httpd-tools-0:2.4.63-13.el10_2.4.x86_64.rpm mod_session-0:2.4.63-13.el10_2.4.x86_64.rpm mod_ldap-debuginfo-0:2.4.63-13.el10_2.4.x86_64.rpm httpd-filesystem-0:2.4.63-13.el10_2.4.noarch.rpm httpd-devel-0:2.4.63-13.el10_2.4.x86_64.rpm mod_proxy_html-1:2.4.63-13.el10_2.4.x86_64.rpm httpd-debuginfo-0:2.4.63-13.el10_2.4.x86_64.rpm mod_ldap-0:2.4.63-13.el10_2.4.x86_64.rpm mod_ssl-1:2.4.63-13.el10_2.4.x86_64.rpm httpd-tools-debuginfo-0:2.4.63-13.el10_2.4.x86_64.rpm httpd-core-0:2.4.63-13.el10_2.4.x86_64.rpm httpd-0:2.4.63-13.el10_2.4.src.rpm mod_ssl-debuginfo-1:2.4.63-13.el10_2.4.x86_64.rpm mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.4.x86_64.rpm httpd-debugsource-0:2.4.63-13.el10_2.4.x86_64.rpm mod_lua-0:2.4.63-13.el10_2.4.x86_64.rpm httpd-manual-0:2.4.63-13.el10_2.4.noarch.rpm mod_session-debuginfo-0:2.4.63-13.el10_2.4.x86_64.rpm

Rocky Linux 10 aarch64 - AppStream

httpd-debugsource-0:2.4.63-13.el10_2.4.aarch64.rpm mod_ssl-1:2.4.63-13.el10_2.4.aarch64.rpm mod_lua-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-filesystem-0:2.4.63-13.el10_2.4.noarch.rpm mod_proxy_html-1:2.4.63-13.el10_2.4.aarch64.rpm mod_ssl-debuginfo-1:2.4.63-13.el10_2.4.aarch64.rpm mod_lua-debuginfo-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-tools-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-0:2.4.63-13.el10_2.4.src.rpm mod_session-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-devel-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-core-0:2.4.63-13.el10_2.4.aarch64.rpm mod_ldap-debuginfo-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-tools-debuginfo-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-core-debuginfo-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-manual-0:2.4.63-13.el10_2.4.noarch.rpm mod_session-debuginfo-0:2.4.63-13.el10_2.4.aarch64.rpm httpd-0:2.4.63-13.el10_2.4.aarch64.rpm mod_ldap-0:2.4.63-13.el10_2.4.aarch64.rpm mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.4.aarch64.rpm httpd-debuginfo-0:2.4.63-13.el10_2.4.aarch64.rpm

Rocky Linux 10 s390x - AppStream

mod_lua-debuginfo-0:2.4.63-13.el10_2.4.s390x.rpm httpd-core-0:2.4.63-13.el10_2.4.s390x.rpm mod_ssl-debuginfo-1:2.4.63-13.el10_2.4.s390x.rpm mod_ldap-debuginfo-0:2.4.63-13.el10_2.4.s390x.rpm httpd-filesystem-0:2.4.63-13.el10_2.4.noarch.rpm httpd-tools-0:2.4.63-13.el10_2.4.s390x.rpm httpd-devel-0:2.4.63-13.el10_2.4.s390x.rpm mod_proxy_html-debuginfo-1:2.4.63-13.el10_2.4.s390x.rpm mod_session-debuginfo-0:2.4.63-13.el10_2.4.s390x.rpm mod_ldap-0:2.4.63-13.el10_2.4.s390x.rpm httpd-debugsource-0:2.4.63-13.el10_2.4.s390x.rpm httpd-0:2.4.63-13.el10_2.4.src.rpm mod_lua-0:2.4.63-13.el10_2.4.s390x.rpm mod_session-0:2.4.63-13.el10_2.4.s390x.rpm httpd-debuginfo-0:2.4.63-13.el10_2.4.s390x.rpm httpd-tools-debuginfo-0:2.4.63-13.el10_2.4.s390x.rpm httpd-manual-0:2.4.63-13.el10_2.4.noarch.rpm httpd-0:2.4.63-13.el10_2.4.s390x.rpm mod_ssl-1:2.4.63-13.el10_2.4.s390x.rpm httpd-core-debuginfo-0:2.4.63-13.el10_2.4.s390x.rpm mod_proxy_html-1:2.4.63-13.el10_2.4.s390x.rpm

Rocky Linux 10 riscv64 - AppStream

httpd-filesystem-0:2.4.63-13.el10_2.4.noarch.rpm httpd-0:2.4.63-13.el10_2.4.src.rpm httpd-manual-0:2.4.63-13.el10_2.4.noarch.rpm