RHSA-2026:74858HighCVSS 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 2, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (19)

CVE-2026-42528 →CVE-2026-48005 →CVE-2026-79768 →CVE-2026-93546 →CVE-2026-47360 →CVE-2026-56449 →CVE-2026-57941 →CVE-2026-63045 →CVE-2026-73636 →CVE-2026-42356 →CVE-2026-56154 →CVE-2026-59797 →CVE-2026-63686 →CVE-2026-63718 →CVE-2026-73637 →CVE-2026-46729 →CVE-2026-56153 →CVE-2026-58415 →CVE-2026-63292 →

📋 Description

CVE-2026-42356 — httpd: httpd: arbitrary code execution via incorrect handler assignment during internal CGI redirects CVE-2026-42528 — httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error CVE-2026-46729 — httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference CVE-2026-47360 — httpd: httpd: Information disclosure via session cookie leakage during internal redirects CVE-2026-48005 — httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest CVE-2026-56153 — httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite CVE-2026-56154 — httpd: httpd: Denial of Service via mod_rewrite lookahead CVE-2026-56449 — httpd: httpd: Denial of Service via crafted HTTP response bodies in mod_proxy_html CVE-2026-57941 — httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy CVE-2026-58415 — httpd: httpd: Information disclosure via direct request to the WebDAV state directory CVE-2026-59797 — httpd: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function CVE-2026-63045 — httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response CVE-2026-63292 — httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias CVE-2026-63686 — httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc CVE-2026-63718 — httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi CVE-2026-73636 — httpd: httpd: Authentication bypass via credential replay in mod_auth_digest CVE-2026-73637 — httpd: httpd: Authentication state corruption via concurrent Digest authentication requests CVE-2026-79768 — httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence CVE-2026-93546 — httpd: httpd: Denial of Service via integer overflow in mod_dav_fs

🎯 Affected products24

  • Red Hat Hardened Images
  • httpd-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-0:2.4.69-1.hum1@src as a component of Red Hat Hardened Images
  • httpd-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • httpd-core-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-core-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • httpd-devel-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-devel-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • httpd-tools-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • httpd-tools-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_ldap-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_ldap-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_lua-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_lua-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_proxy_html-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_proxy_html-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_session-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_session-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mod_ssl-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mod_ssl-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: If CGI functionality is not required, disable CGI execution by commenting out `mod_cgi` or `mod_cgid` in the Apache configuration (for example, in `/etc/httpd/conf.modules.d/01-cgi.conf`), or by removing `ExecCGI` from `Options` directives in `/etc/httpd/conf/httpd.conf`. Apply the changes to the running service: systemctl reload httpd Caveats: Disabling CGI modules or execution options will prevent any existing CGI applications from functioning. Warning: Reloading or restarting the httpd service may temporarily disrupt active connections. Workaround: If WebDAV functionality is not required, disable the mod_dav module by commenting out the `LoadModule dav_module` line in `/etc/httpd/conf.modules.d/00-dav.conf` or setting `Dav Off` within the relevant configuration contexts. If WebDAV is required, restrict lock capabilities to authenticated and trusted clients by limiting the LOCK method within the configuration (for example, using `<Limit LOCK>` blocks with strict `Require` directives). Apply configuration changes by reloading the service: ``` systemctl reload httpd ``` Warning: Disabling mod_dav or restricting lock operations will prevent WebDAV clients from acquiring shared or exclusive resource locks. Reloading the httpd service may briefly affect active HTTP connections. Workaround: Disable the mod_heartmonitor module or restrict network access to the monitoring port: 1. Disable the module: Comment out the LoadModule directive for mod_heartmonitor in the Apache configuration (typically located in `/etc/httpd/conf.modules.d/00-base.conf` or a custom configuration file): # LoadModule heartmonitor_module modules/mod_heartmonitor.so Then reload the web server configuration: systemctl reload httpd 2. Restrict network reachability: If mod_heartmonitor is required, configure firewall rules using firewalld to permit traffic to the HeartbeatListen unicast port only from authorized backend nodes: firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_RANGE> firewall-cmd --reload Caveat: Disabling mod_heartmonitor prevents mod_lbmethod_heartbeat from receiving backend node status, which disables heartbeat-based dynamic load balancing. Warning: Modifying Apache configuration files requires reloading or restarting httpd, which may briefly interrupt active network connections. Workaround: If cookie-based session management is not required, disable the `mod_session_cookie` module. 1. Comment out the module load directive in `/etc/httpd/conf.modules.d/01-session.conf` (or the relevant configuration file): ``` # LoadModule session_cookie_module modules/mod_session_cookie.so ``` 2. Reload the `httpd` service to apply the configuration: ``` systemctl reload httpd ``` Warning: Reloading or restarting the `httpd` service may briefly interrupt active network connections. Additionally, disabling this module will cause any web server configurations or web applications relying on `mod_session_cookie` to fail. Workaround: To mitigate this issue, disable nonce-count verification by setting `AuthDigestNcCheck Off` within the relevant configuration context in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`: AuthDigestNcCheck Off Alternatively, if Digest authentication is not required, disable `mod_auth_digest` by commenting out the corresponding `LoadModule auth_digest_module` line in `/etc/httpd/conf.modules.d/00-base.conf`. After modifying the configuration, reload the service: systemctl reload httpd Caveats: Disabling `AuthDigestNcCheck` removes server-side nonce-count checking, reducing replay protection for Digest authentication. Warning: Reloading the httpd service can momentarily disrupt in-flight connections. Workaround: Disable the mod_charset_lite module if character set translation is not required. 1. Locate the configuration file loading the module, typically within `/etc/httpd/conf.modules.d/` (such as `00-base.conf` or a dedicated module configuration file). 2. Comment out or remove the `LoadModule charset_lite_module` line: ``` # LoadModule charset_lite_module modules/mod_charset_lite.so ``` 3. Reload the httpd service to apply the configuration change: ``` systemctl reload httpd ``` Caveats: Applications that depend on mod_charset_lite for on-the-fly character set conversion will fail to translate character sets once the module is disabled. Warning: Reloading or restarting the httpd service will momentarily disrupt active network connections or in-flight requests. Workaround: Review the effective Apache HTTP Server configuration, including virtual host configurations and .htaccess files, for affected HTTP-header lookahead expressions such as %{LA-U:HTTP:...}. Remove or replace these expressions where application requirements permit. Alternatively, disable mod_rewrite if the application does not require it. These changes may affect URL rewriting and application routing. Validate the configuration and reload or restart the service as appropriate. Apply a vendor-supported security update containing the fix when available. Workaround: Disable the `mod_proxy_html` module if HTML link rewriting is not required: 1. Comment out the module loader directive in `/etc/httpd/conf.modules.d/00-proxyhtml.conf`: ``` # sed -i 's/^\s*LoadModule proxy_html_module/#&/' /etc/httpd/conf.modules.d/00-proxyhtml.conf ``` Alternatively, set `ProxyHTMLEnable Off` in the affected server or virtual host configuration. 2. Reload the Apache HTTP Server: ``` # systemctl reload httpd ``` Caveats: Disabling `mod_proxy_html` or turning off `ProxyHTMLEnable` halts automated rewriting of URLs in proxied HTML responses, which may break web applications that depend on backend path translation. Warning: Reloading or restarting the `httpd` service may temporarily interrupt active network connections. Workaround: Disable mod_http2 until a fixed package is installed. In /etc/httpd/conf.modules.d/10-h2.conf, comment out the module and restart the service: #LoadModule http2_module modules/mod_http2.so $ systemctl restart httpd Workaround: To mitigate this flaw, block direct HTTP requests to the internal WebDAV state directory, or disable the mod_dav_fs module if WebDAV functionality is not required. 1. Block access to the .DAV directory: Create or edit a configuration snippet, such as `/etc/httpd/conf.d/block-dav-state.conf`, with the following directive: <LocationMatch "(^|/)\.DAV"> Require all denied </LocationMatch> 2. Alternatively, disable the module if WebDAV is not used: Comment out the following line in `/etc/httpd/conf.modules.d/00-dav.conf`: # LoadModule dav_fs_module modules/mod_dav_fs.so 3. Apply changes: Verify the configuration syntax: # apachectl configtest Reload the service: # systemctl reload httpd Warning: Reloading or restarting httpd will impact active network connections. Ensure configuration syntax is validated before reloading to avoid service interruption. Disabling mod_dav_fs will stop all WebDAV filesystem storage operations. Workaround: Prevent untrusted users from using SSLRequire in .htaccess files. Where directory-level overrides are not required, disable them in the trusted server configuration for each affected directory: <Directory "/path/to/content"> AllowOverride None AllowOverrideList None </Directory> Move any required .htaccess settings into the trusted server configuration before disabling overrides. Validate the configuration and reload or restart the appropriate Apache HTTP Server instance using the deployment's standard procedure. Disabling overrides can change authentication, access controls, and URL rewriting that depend on .htaccess files. Apply a vendor-supported security update when available. Workaround: Disable the mod_proxy_ftp module or ensure forward proxying is disabled in the Apache HTTP Server configuration. 1. Comment out the…

🔗 References (23)