RHSA-2026:92616HighCVSS 8.1

Red Hat Security Advisory: httpd:2.4 security, bug fix, and enhancement update

Published
October 29, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (12)

CVE-2026-33006 →CVE-2026-46729 →CVE-2026-48005 →CVE-2026-56153 →CVE-2026-56154 →CVE-2026-63292 →CVE-2026-73636 →CVE-2026-73637 →CVE-2026-63045 →CVE-2026-63686 →CVE-2026-63718 →CVE-2026-93546 →

📋 Description

CVE-2026-33006 — httpd: mod_auth_digest: timing attack allows a bypass of digest authentication CVE-2026-46729 — httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference CVE-2026-48005 — httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest CVE-2026-56153 — httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite CVE-2026-56154 — httpd: httpd: Denial of Service via mod_rewrite lookahead CVE-2026-63045 — httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response CVE-2026-63292 — httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias CVE-2026-63686 — httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc CVE-2026-63718 — httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi CVE-2026-73636 — httpd: httpd: Authentication bypass via credential replay in mod_auth_digest CVE-2026-73637 — httpd: httpd: Authentication state corruption via concurrent Digest authentication requests CVE-2026-93546 — httpd: httpd: Denial of Service via integer overflow in mod_dav_fs

🎯 Affected products86

  • Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.src (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-filesystem-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.noarch (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-manual-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.noarch (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-65.module+el8.10.0+25092+6f3ea0dd.13.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • mod_http2-0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • mod_http2-0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +56 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Disable the mod_heartmonitor module or restrict network access to the monitoring port: 1. Disable the module: Comment out the LoadModule directive for mod_heartmonitor in the Apache configuration (typically located in `/etc/httpd/conf.modules.d/00-base.conf` or a custom configuration file): # LoadModule heartmonitor_module modules/mod_heartmonitor.so Then reload the web server configuration: systemctl reload httpd 2. Restrict network reachability: If mod_heartmonitor is required, configure firewall rules using firewalld to permit traffic to the HeartbeatListen unicast port only from authorized backend nodes: firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_RANGE> firewall-cmd --reload Caveat: Disabling mod_heartmonitor prevents mod_lbmethod_heartbeat from receiving backend node status, which disables heartbeat-based dynamic load balancing. Warning: Modifying Apache configuration files requires reloading or restarting httpd, which may briefly interrupt active network connections. Workaround: To mitigate this issue, disable nonce-count verification by setting `AuthDigestNcCheck Off` within the relevant configuration context in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`: AuthDigestNcCheck Off Alternatively, if Digest authentication is not required, disable `mod_auth_digest` by commenting out the corresponding `LoadModule auth_digest_module` line in `/etc/httpd/conf.modules.d/00-base.conf`. After modifying the configuration, reload the service: systemctl reload httpd Caveats: Disabling `AuthDigestNcCheck` removes server-side nonce-count checking, reducing replay protection for Digest authentication. Warning: Reloading the httpd service can momentarily disrupt in-flight connections. Workaround: Disable the mod_charset_lite module if character set translation is not required. 1. Locate the configuration file loading the module, typically within `/etc/httpd/conf.modules.d/` (such as `00-base.conf` or a dedicated module configuration file). 2. Comment out or remove the `LoadModule charset_lite_module` line: ``` # LoadModule charset_lite_module modules/mod_charset_lite.so ``` 3. Reload the httpd service to apply the configuration change: ``` systemctl reload httpd ``` Caveats: Applications that depend on mod_charset_lite for on-the-fly character set conversion will fail to translate character sets once the module is disabled. Warning: Reloading or restarting the httpd service will momentarily disrupt active network connections or in-flight requests. Workaround: Review the effective Apache HTTP Server configuration, including virtual host configurations and .htaccess files, for affected HTTP-header lookahead expressions such as %{LA-U:HTTP:...}. Remove or replace these expressions where application requirements permit. Alternatively, disable mod_rewrite if the application does not require it. These changes may affect URL rewriting and application routing. Validate the configuration and reload or restart the service as appropriate. Apply a vendor-supported security update containing the fix when available. Workaround: Disable the mod_proxy_ftp module or ensure forward proxying is disabled in the Apache HTTP Server configuration. 1. Comment out the mod_proxy_ftp module load line in `/etc/httpd/conf.modules.d/00-proxy.conf`: ``` # LoadModule proxy_ftp_module modules/mod_proxy_ftp.so ``` 2. Ensure forward proxying is turned off in `/etc/httpd/conf/httpd.conf`: ``` ProxyRequests Off ``` 3. Reload the httpd service to apply changes: ``` systemctl reload httpd ``` Caveat: Disabling mod_proxy_ftp terminates the ability of httpd to proxy FTP requests. Warning: Reloading or restarting the httpd service will briefly affect active connections while configuration changes are reloaded. Workaround: To mitigate this vulnerability without code modifications, ensure that `LimitRequestFieldSize` remains at or below its default limit of 8190 bytes, or disable the `mod_vhost_alias` module if dynamic virtual hosting is not required. 1. Ensure `LimitRequestFieldSize` is not configured above 8190 in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`: ``` LimitRequestFieldSize 8190 ``` 2. Alternatively, if `mod_vhost_alias` is not needed, disable it by commenting out its loading directive in `/etc/httpd/conf.modules.d/00-base.conf`: ``` # LoadModule vhost_alias_module modules/mod_vhost_alias.so ``` 3. Validate the configuration syntax and reload the service: ``` apachectl configtest systemctl reload httpd ``` Caveats: Restricting `LimitRequestFieldSize` may reject legitimate requests that carry exceptionally large HTTP headers, returning a 400 Bad Request response. Disabling `mod_vhost_alias` prevents the use of dynamic virtual host directives such as `VirtualDocumentRoot`. Warning: Reloading or restarting the `httpd` daemon may briefly affect in-flight network connections. Workaround: If proxy character set transcoding is not required, disable the mod_xml2enc module by commenting out its configuration directive. 1. Edit the module configuration file (typically located under `/etc/httpd/conf.modules.d/`) and comment out the loading directive: # LoadModule xml2enc_module modules/mod_xml2enc.so 2. Verify the configuration syntax: httpd -t 3. Reload the Apache HTTP Server to apply changes: systemctl reload httpd Caveats: Disabling mod_xml2enc will break modules that depend on XML or HTML character set conversion, such as mod_proxy_html. If this module is required, restrict proxy rules so httpd communicates only with trusted upstream backends. Warning: Reloading or restarting the httpd service may cause a brief interruption to active connections. Workaround: If uWSGI proxy functionality is not required, disable the mod_proxy_uwsgi module: 1. Edit the Apache proxy module configuration file (typically `/etc/httpd/conf.modules.d/00-proxy.conf`) and comment out the loading directive: # LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so 2. Restart the Apache HTTP Server daemon: systemctl restart httpd Warning: Restarting the httpd service causes an immediate disruption to active client connections. Disabling this module will prevent the server from handling requests routed through the uWSGI protocol. Workaround: Ensure that `AuthDigestNonceLifetime` is not set to `0`. If digest authentication is not required, disable `mod_auth_digest`. 1. To retain digest authentication with safe settings, set a positive non-zero value (such as the default 300 seconds) or remove the explicit zero setting from `/etc/httpd/conf/httpd.conf` or relevant files in `/etc/httpd/conf.d/`: ``` AuthDigestNonceLifetime 300 ``` 2. If HTTP digest authentication is not needed, disable the module by commenting out the corresponding line in `/etc/httpd/conf.modules.d/00-base.conf`: ``` #LoadModule auth_digest_module modules/mod_auth_digest.so ``` 3. Restart the web server to apply changes: ``` systemctl restart httpd ``` Warning: Restarting or reloading the httpd service will briefly disrupt active client connections. Disabling the module will break authentication for virtual hosts or directories relying on digest authentication. Workaround: To mitigate this issue, apply one of the following configuration options: 1. Disable `mod_auth_digest` if Digest authentication is not required: In `/etc/httpd/conf.modules.d/00-base.conf` (or the relevant module configuration file), comment out the loading of the module: ``` # LoadModule auth_digest_module modules/mod_auth_digest.so ``` 2. If Digest authentication is required, ensure vulnerabl…

🔗 References (15)