RHSA-2026:89860HighCVSS 8.1

Red Hat Security Advisory: httpd security update

Published
October 26, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (11)

CVE-2026-48005 →CVE-2026-56154 →CVE-2026-63045 →CVE-2026-63686 →CVE-2026-73636 →CVE-2026-73637 →CVE-2026-56153 →CVE-2026-63292 →CVE-2026-63718 →CVE-2026-93546 →CVE-2026-46729 →

📋 Description

CVE-2026-46729 — httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference CVE-2026-48005 — httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest CVE-2026-56153 — httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite CVE-2026-56154 — httpd: httpd: Denial of Service via mod_rewrite lookahead CVE-2026-63045 — httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response CVE-2026-63292 — httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias CVE-2026-63686 — httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc CVE-2026-63718 — httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi CVE-2026-73636 — httpd: httpd: Authentication bypass via credential replay in mod_auth_digest CVE-2026-73637 — httpd: httpd: Authentication state corruption via concurrent Digest authentication requests CVE-2026-93546 — httpd: httpd: Denial of Service via integer overflow in mod_dav_fs

🎯 Affected products76

  • Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-0:2.4.63-13.el10_2.8.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-core-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debuginfo-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debuginfo-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debuginfo-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debuginfo-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debugsource-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debugsource-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debugsource-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-debugsource-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-devel-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-devel-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-devel-0:2.4.63-13.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-devel-0:2.4.63-13.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-filesystem-0:2.4.63-13.el10_2.8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-manual-0:2.4.63-13.el10_2.8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-tools-0:2.4.63-13.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • httpd-tools-0:2.4.63-13.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +46 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Disable the mod_heartmonitor module or restrict network access to the monitoring port: 1. Disable the module: Comment out the LoadModule directive for mod_heartmonitor in the Apache configuration (typically located in `/etc/httpd/conf.modules.d/00-base.conf` or a custom configuration file): # LoadModule heartmonitor_module modules/mod_heartmonitor.so Then reload the web server configuration: systemctl reload httpd 2. Restrict network reachability: If mod_heartmonitor is required, configure firewall rules using firewalld to permit traffic to the HeartbeatListen unicast port only from authorized backend nodes: firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_RANGE> firewall-cmd --reload Caveat: Disabling mod_heartmonitor prevents mod_lbmethod_heartbeat from receiving backend node status, which disables heartbeat-based dynamic load balancing. Warning: Modifying Apache configuration files requires reloading or restarting httpd, which may briefly interrupt active network connections. Workaround: To mitigate this issue, disable nonce-count verification by setting `AuthDigestNcCheck Off` within the relevant configuration context in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`: AuthDigestNcCheck Off Alternatively, if Digest authentication is not required, disable `mod_auth_digest` by commenting out the corresponding `LoadModule auth_digest_module` line in `/etc/httpd/conf.modules.d/00-base.conf`. After modifying the configuration, reload the service: systemctl reload httpd Caveats: Disabling `AuthDigestNcCheck` removes server-side nonce-count checking, reducing replay protection for Digest authentication. Warning: Reloading the httpd service can momentarily disrupt in-flight connections. Workaround: Disable the mod_charset_lite module if character set translation is not required. 1. Locate the configuration file loading the module, typically within `/etc/httpd/conf.modules.d/` (such as `00-base.conf` or a dedicated module configuration file). 2. Comment out or remove the `LoadModule charset_lite_module` line: ``` # LoadModule charset_lite_module modules/mod_charset_lite.so ``` 3. Reload the httpd service to apply the configuration change: ``` systemctl reload httpd ``` Caveats: Applications that depend on mod_charset_lite for on-the-fly character set conversion will fail to translate character sets once the module is disabled. Warning: Reloading or restarting the httpd service will momentarily disrupt active network connections or in-flight requests. Workaround: Review the effective Apache HTTP Server configuration, including virtual host configurations and .htaccess files, for affected HTTP-header lookahead expressions such as %{LA-U:HTTP:...}. Remove or replace these expressions where application requirements permit. Alternatively, disable mod_rewrite if the application does not require it. These changes may affect URL rewriting and application routing. Validate the configuration and reload or restart the service as appropriate. Apply a vendor-supported security update containing the fix when available. Workaround: Disable the mod_proxy_ftp module or ensure forward proxying is disabled in the Apache HTTP Server configuration. 1. Comment out the mod_proxy_ftp module load line in `/etc/httpd/conf.modules.d/00-proxy.conf`: ``` # LoadModule proxy_ftp_module modules/mod_proxy_ftp.so ``` 2. Ensure forward proxying is turned off in `/etc/httpd/conf/httpd.conf`: ``` ProxyRequests Off ``` 3. Reload the httpd service to apply changes: ``` systemctl reload httpd ``` Caveat: Disabling mod_proxy_ftp terminates the ability of httpd to proxy FTP requests. Warning: Reloading or restarting the httpd service will briefly affect active connections while configuration changes are reloaded. Workaround: To mitigate this vulnerability without code modifications, ensure that `LimitRequestFieldSize` remains at or below its default limit of 8190 bytes, or disable the `mod_vhost_alias` module if dynamic virtual hosting is not required. 1. Ensure `LimitRequestFieldSize` is not configured above 8190 in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`: ``` LimitRequestFieldSize 8190 ``` 2. Alternatively, if `mod_vhost_alias` is not needed, disable it by commenting out its loading directive in `/etc/httpd/conf.modules.d/00-base.conf`: ``` # LoadModule vhost_alias_module modules/mod_vhost_alias.so ``` 3. Validate the configuration syntax and reload the service: ``` apachectl configtest systemctl reload httpd ``` Caveats: Restricting `LimitRequestFieldSize` may reject legitimate requests that carry exceptionally large HTTP headers, returning a 400 Bad Request response. Disabling `mod_vhost_alias` prevents the use of dynamic virtual host directives such as `VirtualDocumentRoot`. Warning: Reloading or restarting the `httpd` daemon may briefly affect in-flight network connections. Workaround: If proxy character set transcoding is not required, disable the mod_xml2enc module by commenting out its configuration directive. 1. Edit the module configuration file (typically located under `/etc/httpd/conf.modules.d/`) and comment out the loading directive: # LoadModule xml2enc_module modules/mod_xml2enc.so 2. Verify the configuration syntax: httpd -t 3. Reload the Apache HTTP Server to apply changes: systemctl reload httpd Caveats: Disabling mod_xml2enc will break modules that depend on XML or HTML character set conversion, such as mod_proxy_html. If this module is required, restrict proxy rules so httpd communicates only with trusted upstream backends. Warning: Reloading or restarting the httpd service may cause a brief interruption to active connections. Workaround: If uWSGI proxy functionality is not required, disable the mod_proxy_uwsgi module: 1. Edit the Apache proxy module configuration file (typically `/etc/httpd/conf.modules.d/00-proxy.conf`) and comment out the loading directive: # LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so 2. Restart the Apache HTTP Server daemon: systemctl restart httpd Warning: Restarting the httpd service causes an immediate disruption to active client connections. Disabling this module will prevent the server from handling requests routed through the uWSGI protocol. Workaround: Ensure that `AuthDigestNonceLifetime` is not set to `0`. If digest authentication is not required, disable `mod_auth_digest`. 1. To retain digest authentication with safe settings, set a positive non-zero value (such as the default 300 seconds) or remove the explicit zero setting from `/etc/httpd/conf/httpd.conf` or relevant files in `/etc/httpd/conf.d/`: ``` AuthDigestNonceLifetime 300 ``` 2. If HTTP digest authentication is not needed, disable the module by commenting out the corresponding line in `/etc/httpd/conf.modules.d/00-base.conf`: ``` #LoadModule auth_digest_module modules/mod_auth_digest.so ``` 3. Restart the web server to apply changes: ``` systemctl restart httpd ``` Warning: Restarting or reloading the httpd service will briefly disrupt active client connections. Disabling the module will break authentication for virtual hosts or directories relying on digest authentication. Workaround: To mitigate this issue, apply one of the following configuration options: 1. Disable `mod_auth_digest` if Digest authentication is not required: In `/etc/httpd/conf.modules.d/00-base.conf` (or the relevant module configuration file), comment out the loading of the module: ``` # LoadModule auth_digest_module modules/mod_auth_digest.so ``` 2. If Digest authentication is required, ensure vulnerable settings are disabled: Ensure `AuthDigestNcCheck` is set to `Off` (or removed, as `Off` is the default) and ensure `AuthDigestNonceLifetime` is not set to `0` (the default value is 300 seconds). After applying configuration adjustments, reload …

🔗 References (14)