RHSA-2026:98998CriticalCVSS 9.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
November 11, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (2)

CVE-2026-119618 →CVE-2026-109163 →

📋 Description

CVE-2026-109163 — httpd: httpd: Denial of Service via stack-based buffer overflow in mod_vhost_alias CVE-2026-119618 — httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2

🎯 Affected products35

  • Red Hat Hardened Images
  • httpd-0:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-0:2.4.71-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • httpd-0:2.4.71-0.1.hum1@src as a component of Red Hat Hardened Images
  • httpd-0:2.4.71-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • httpd-core-0:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-core-0:2.4.71-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • httpd-core-0:2.4.71-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • httpd-devel-0:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-devel-0:2.4.71-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • httpd-devel-0:2.4.71-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • httpd-filesystem-0:2.4.71-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • httpd-filesystem-0:2.4.71-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • httpd-filesystem-0:2.4.71-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • httpd-manual-0:2.4.71-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • httpd-manual-0:2.4.71-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • httpd-manual-0:2.4.71-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • httpd-tools-0:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-tools-0:2.4.71-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • httpd-tools-0:2.4.71-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_ldap-0:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_ldap-0:2.4.71-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mod_ldap-0:2.4.71-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_lua-0:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_lua-0:2.4.71-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mod_lua-0:2.4.71-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_proxy_html-1:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_proxy_html-1:2.4.71-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mod_proxy_html-1:2.4.71-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_session-0:2.4.71-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • +5 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: If dynamic mass virtual hosting is not required, disable the `mod_vhost_alias` module: 1. Comment out the `vhost_alias_module` line in `/etc/httpd/conf.modules.d/00-base.conf` (or the respective configuration file loading the module): ``` # LoadModule vhost_alias_module modules/mod_vhost_alias.so ``` 2. Restart the Apache HTTP Server service to apply the change: ``` systemctl restart httpd ``` Warning: Restarting or reloading the `httpd` service interrupts active connections. Disabling `mod_vhost_alias` will break virtual host resolution for deployments configured with directives such as `VirtualDocumentRoot` or `VirtualScriptAlias`. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (7)