RHSA-2026:13938HighCVSS 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
May 6, 2026
Last Modified
September 14, 2026

🔗 CVE IDs covered (6)

CVE-2026-24072 →CVE-2026-33007 →CVE-2026-33857 →CVE-2026-34032 →CVE-2026-34059 →CVE-2026-23918 →

📋 Description

CVE-2026-23918 — Apache HTTP Server: Apache HTTP Server: Remote Code Execution via Double Free in HTTP/2 Protocol CVE-2026-24072 — Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation CVE-2026-33007 — httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash CVE-2026-33857 — httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions CVE-2026-34032 — httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check CVE-2026-34059 — httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

🎯 Affected products5

  • Red Hat Hardened Images
  • httpd-main@aarch64 as a component of Red Hat Hardened Images
  • httpd-main@noarch as a component of Red Hat Hardened Images
  • httpd-main@src as a component of Red Hat Hardened Images
  • httpd-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, disable the `mod_http2` module in your Apache HTTP Server configuration. This can be achieved by commenting out or removing the `LoadModule http2_module modules/mod_http2.so` line in the Apache configuration file (e.g., `/etc/httpd/conf.modules.d/00-base.conf` or a similar configuration file). After modifying the configuration, restart the httpd service for the changes to take effect. This action will impact services relying on HTTP/2 functionality. Workaround: To prevent local users from exploiting this flaw via .htaccess file manipulation, configure Apache HTTP Server to disable .htaccess overrides. Set `AllowOverride None` within the main server configuration or relevant `<Directory>` blocks. This restricts the ability of local users to alter server settings. After applying this change, the `httpd` service must be reloaded or restarted for the new configuration to take effect. Example configuration: ``` <Directory "/var/www/html"> AllowOverride None </Directory> ``` To apply changes, reload the service: `sudo systemctl reload httpd` Or restart the service: `sudo systemctl restart httpd` Workaround: Disabling mod_authn_socache and restarting httpd will mitigate this flaw. Workaround: Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.

🔗 References (10)