RHSA-2026:25042HighCVSS 7.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
June 10, 2026
Last Modified
August 18, 2026

🔗 CVE IDs covered (13)

CVE-2026-44631 →CVE-2026-48913 →CVE-2026-29167 →CVE-2026-34355 →CVE-2026-42535 →CVE-2026-44186 →CVE-2026-49975 →CVE-2026-29170 →CVE-2026-34356 →CVE-2026-42536 →CVE-2026-43951 →CVE-2026-44119 →CVE-2026-44185 →

📋 Description

CVE-2026-29167 — httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration CVE-2026-29170 — httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation CVE-2026-34355 — httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass CVE-2026-34356 — httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers CVE-2026-42535 — httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue CVE-2026-42536 — httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc CVE-2026-43951 — httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime CVE-2026-44119 — httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges CVE-2026-44185 — httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server CVE-2026-44186 — httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server CVE-2026-44631 — httpd: Apache HTTP Server: Denial of Service via crafted regular expressions CVE-2026-48913 — httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. CVE-2026-49975 — httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

🎯 Affected products5

  • Red Hat Hardened Images
  • httpd-main@aarch64 as a component of Red Hat Hardened Images
  • httpd-main@noarch as a component of Red Hat Hardened Images
  • httpd-main@src as a component of Red Hat Hardened Images
  • httpd-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: upgrade apache web server to 2.4.68 Workaround: Disable the `mod_proxy_html` module if it is not essential for your Apache HTTP Server configuration. If `mod_proxy_html` is required, restrict its use to trusted backend servers only, employing network segmentation and access controls. After modifying the configuration, reload the httpd service for changes to apply, which may cause a brief service interruption. Steps to disable: Open /etc/httpd/conf.modules.d/00-proxy.conf. Add a # to comment out the line: LoadModule proxy_html_module modules/mod_proxy_html.so Verify configuration syntax: apachectl configtest Apply the change gracefully: systemctl reload httpd Workaround: To prevent this denial-of-service flaw, ensure your Apache proxy rules only connect to highly trusted backend servers. If you must proxy traffic to unverified or external backends, disable the cookie-rewriting features. Steps to Mitigate: Open your Apache configuration file (e.g., /etc/httpd/conf/httpd.conf). Locate and comment out any ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath lines pointing to untrusted backends by adding a # at the start of the line. Test your syntax: apachectl configtest Apply changes gracefully: systemctl reload httpd Note: This may cause a brief service interruption. Workaround: To mitigate this vulnerability, disable the `mod_xml2enc` module if its functionality for XML internationalization is not essential. This can be done by commenting out the `LoadModule xml2enc_module modules/mod_xml2enc.so` directive in the Apache HTTP Server configuration. A service restart is required for the change to take effect. ```bash # Edit the Apache configuration file, e.g., /etc/httpd/conf.modules.d/00-base.conf # Comment out the line: # LoadModule xml2enc_module modules/mod_xml2enc.so # Reload the httpd service sudo systemctl reload httpd ``` *Note: Disabling `mod_xml2enc` will cause any configurations relying heavily on `mod_proxy_html` or raw HTML/XML encoding conversions to function incorrectly or fail. Red Hat strongly recommends upgrading to a patched version of `httpd` as soon as it becomes available for your specific RHEL channel.* Workaround: - Those who do not require multi-language response headers can remove or disable the `mod_headers` and `mod_mime` modules, or remove Content-Language directives from their configuration. - Systems not using these modules in combination are not affected. Workaround: To mitigate this issue, ensure that Apache HTTP Server is configured to only communicate with trusted OCSP responders. If OCSP validation or stapling is not a critical requirement for your deployment, consider disabling it. This can be achieved by adjusting mod_ssl directives in your Apache HTTP Server configuration. For example, add or modify the following lines: ~~~ SSLOCSPEnable off SSLUseStapling off ~~~ After modifying the configuration, reload the httpd service for the changes to take effect safely without interrupting active connections: ~~~ sudo systemctl reload httpd ~~~ Workaround: To mitigate this issue, you can disable the `mod_proxy_ftp` module if your environment does not require it. #### **Step 1: Disable the Module** Open your Apache HTTP Server configuration file (commonly located at `/etc/httpd/conf.modules.d/00-proxy.conf` or `/etc/httpd/conf/httpd.conf`) and comment out or remove the following line: ``` # LoadModule proxy_ftp_module modules/mod_proxy_ftp.so ``` #### **Step 2: Restart the Service** Restart the `httpd` service to apply the configuration changes: ``` systemctl restart httpd ``` **Note:** Disabling this module may impact applications or services that rely on Apache's FTP proxy functionality. Workaround: Only loadtrustedApache configuration; the bug triggers oncrafted regexin config at start/reload (DirectoryMatch,Directory ~,ProxyMatch, etc.). Keep AllowOverride None where possible so untrusted users cannot inject regex via .htaccess. Restrict who can change httpdconfig and reload the service. Workaround: To mitigate this issue, disable the `mod_http2` module if HTTP/2 protocol support is not required. This can be achieved by commenting out or removing the `LoadModule http2_module modules/mod_http2.so` line in the Apache HTTP Server configuration file (e.g., `/etc/httpd/conf.modules.d/00-base.conf` or similar). After modifying the configuration, the httpd service must be restarted for the changes to take effect. This action may impact services relying on HTTP/2. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (17)