ELBA-2026-50158-0

ELBA-2026-50158-0 - httpd bug fix and enhancement update

Type:	BUG
Impact:	NA
Release Date:	2026-08-04

Description

[2.4.63-13.0.1.el10_2.5]
- Replace index.html with Oracle's index page oracle_index.html.

[2.4.63-13.5]
- Resolves: RHEL-192750 - mod_proxy_html regression in CVE-2026-34355 fix

[2.4.63-13.4]
- Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)
- Resolves: RHEL-186195 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via untrusted content in mod_xml2enc (CVE-2026-42536)
- Resolves: RHEL-186182 - httpd: Apache HTTP Server: Buffer overflow in
mod_proxy_html allows security bypass (CVE-2026-34355)
- Resolves: RHEL-186158 - httpd: Apache HTTP Server: Buffer Over-read via
outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
- Resolves: RHEL-184305 - httpd: Apache HTTP Server: Denial of Service via
crafted regular expressions (CVE-2026-44631)
- Resolves : RHEL-182581 - httpd: incomplete fix for
CVE-2023-38709 (CVE-2024-42516)
- Resolves: RHEL-175621 - httpd: NULL pointer dereference via specially crafted
request (CVE-2026-29169)
- Also addresses CVE-2026-44119, CVE-2026-44186, CVE-2026-42535,
CVE-2026-24072, CVE-2026-33006, CVE-2026-43951

[2.4.63-13.1]
- Resolves: RHEL-173549 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175065 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175095 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175039 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175050 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	httpd-2.4.63-13.0.1.el10_2.5.src.rpm	a3c1c0549c9d41eba6b7f792add66164f4a3f36b91f1ba5c69081b49216ac2f3	-	ol10_aarch64_appstream
	httpd-2.4.63-13.0.1.el10_2.5.aarch64.rpm	4e177b48691e8fc554ea790661ba675cb81f41ba4b7499f65993b5771595d5d3	-	ol10_aarch64_appstream
	httpd-core-2.4.63-13.0.1.el10_2.5.aarch64.rpm	0cba8ce5a169ff99862523739842502b248b18377724874ae30aca1a73640ae3	-	ol10_aarch64_appstream
	httpd-devel-2.4.63-13.0.1.el10_2.5.aarch64.rpm	ddf2bcf1314b5bc3af352334b21daf21c7e26740a23afa198f0051bf74bef5bc	-	ol10_aarch64_appstream
	httpd-filesystem-2.4.63-13.0.1.el10_2.5.noarch.rpm	90cbdd91a485f42a894871f7b76c4129cbbef4f4c91ba48fe9ea6599554f1861	-	ol10_aarch64_appstream
	httpd-manual-2.4.63-13.0.1.el10_2.5.noarch.rpm	f6ac82121af20abba3790e2965845f66807a5209c84653134b16e0c0f69dfe3d	-	ol10_aarch64_appstream
	httpd-tools-2.4.63-13.0.1.el10_2.5.aarch64.rpm	f933a34eefa75638b9dc9d6432798d5eec5e2addf8786fab0353c7ff9d906980	-	ol10_aarch64_appstream
	mod_ldap-2.4.63-13.0.1.el10_2.5.aarch64.rpm	0790aa7d0a352c152a14be39954894c7df50b62b1133e83c64c64b6807b84442	-	ol10_aarch64_appstream
	mod_lua-2.4.63-13.0.1.el10_2.5.aarch64.rpm	e8fe53a454bcc8d0fbd6561571ece7d28b7510d380eafc7a71453710ddf03b30	-	ol10_aarch64_appstream
	mod_proxy_html-2.4.63-13.0.1.el10_2.5.aarch64.rpm	73543b771b73ebb387c65c7717e4a8167416c6bf93eb6cdd9d3203c6e9644bb5	-	ol10_aarch64_appstream
	mod_session-2.4.63-13.0.1.el10_2.5.aarch64.rpm	c96594659875e219660fcac72f2b988e559a82e54703e1183a955152cc69d766	-	ol10_aarch64_appstream
	mod_ssl-2.4.63-13.0.1.el10_2.5.aarch64.rpm	0f93138df2f9517e3724f8d23929b4087c7bfba63b18f9fd353d50692b5c4424	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	httpd-2.4.63-13.0.1.el10_2.5.src.rpm	a3c1c0549c9d41eba6b7f792add66164f4a3f36b91f1ba5c69081b49216ac2f3	-	ol10_x86_64_appstream
	httpd-2.4.63-13.0.1.el10_2.5.x86_64.rpm	bcb0b237cd5d38ce022685ee1324a67a6983a84a5b57c0bd601a46797546f370	-	ol10_x86_64_appstream
	httpd-core-2.4.63-13.0.1.el10_2.5.x86_64.rpm	886f06b5208877615c5ba12603be47712008953337021a09b4103e36199c978c	-	ol10_x86_64_appstream
	httpd-devel-2.4.63-13.0.1.el10_2.5.x86_64.rpm	717fdf9b71162215d26665202f1b8ef09244b197d8213e69651617d6fb6352db	-	ol10_x86_64_appstream
	httpd-filesystem-2.4.63-13.0.1.el10_2.5.noarch.rpm	90cbdd91a485f42a894871f7b76c4129cbbef4f4c91ba48fe9ea6599554f1861	-	ol10_x86_64_appstream
	httpd-manual-2.4.63-13.0.1.el10_2.5.noarch.rpm	f6ac82121af20abba3790e2965845f66807a5209c84653134b16e0c0f69dfe3d	-	ol10_x86_64_appstream
	httpd-tools-2.4.63-13.0.1.el10_2.5.x86_64.rpm	11a7ee6b761699aeafb785db16e88597faef081d62224a5cf08610337bf31fce	-	ol10_x86_64_appstream
	mod_ldap-2.4.63-13.0.1.el10_2.5.x86_64.rpm	b73f70128cff5ed5f0f68fd48bd0e16485e205148035d24f9d5475299e4a6e06	-	ol10_x86_64_appstream
	mod_lua-2.4.63-13.0.1.el10_2.5.x86_64.rpm	0f88dd04cac768d4b35d53ecafa38d8203b4307e58f547140acdf74f42680a5e	-	ol10_x86_64_appstream
	mod_proxy_html-2.4.63-13.0.1.el10_2.5.x86_64.rpm	d1aa81d4e69087841a000285bfcef5e633021abf2951af8e39ea5b816398efaf	-	ol10_x86_64_appstream
	mod_session-2.4.63-13.0.1.el10_2.5.x86_64.rpm	3a64df3fe4521e96f5bf52acab3ab6fb52d7e84407c17d8bc24590ad458c989c	-	ol10_x86_64_appstream
	mod_ssl-2.4.63-13.0.1.el10_2.5.x86_64.rpm	4651a87ecebbe68ad1e1dd29c9984b320141d544b996d0d853b856bbf7c22b50	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team