ELSA-2026-88229
- ULN >
- Oracle Linux Errata repository >
- ELSA-2026-88229
ELSA-2026-88229 - httpd security update
| Type: | SECURITY |
| Impact: | IMPORTANT |
| Release Date: | 2026-10-22 |
Description
[2.4.62-13.0.1.el9_8.9]
- Replace index.html with Oracle's index page oracle_index.html.
[2.4.62-13.9]
- Related: RHEL-275261 - httpd: Arbitrary code execution via oversized Host
header in mod_vhost_alias (CVE-2026-63292)
- Resolves: RHEL-280369 - httpd: Denial of Service via mod_rewrite
lookahead (CVE-2026-56154)
[2.4.62-13.7]
- Resolves: RHEL-275551 CVE-2026-48005 httpd: Denial of service via forged
Authorization headers in mod_auth_digest
- Resolves: RHEL-275338 CVE-2026-73636 httpd: Authentication bypass via
credential replay in mod_auth_digest
- Resolves: RHEL-275229 CVE-2026-73637 httpd: Authentication state corruption
via concurrent Digest authentication requests
- Resolves: RHEL-275323 CVE-2026-56153 httpd: Denial of Service via heap-based
buffer overflow in mod_charset_lite
- Resolves: RHEL-275307 CVE-2026-46729 httpd: mod_heartmonitor: Denial of
Service via NULL pointer dereference
- Resolves: RHEL-275276 CVE-2026-63045 httpd: unauthorized connection to
arbitrary hosts via crafted FTP PASV response
- Resolves: RHEL-275261 CVE-2026-63292 httpd: Arbitrary code execution via
oversized Host header in mod_vhost_alias
- Resolves: RHEL-275245 CVE-2026-63686 httpd: Denial of Service via charset
conversion failure in mod_xml2enc
- Resolves: RHEL-275214 CVE-2026-93546 httpd: Denial of Service via integer
overflow in mod_dav_fs
- Resolves: RHEL-275176 CVE-2026-63718 httpd: HTTP response smuggling via
crafted Transfer-Encoding response in mod_proxy_uwsgi
[2.4.62-13.6]
- Resolves: RHEL-190807 - httpd: use-after-free in mod_ldap
uldap_connection_find via per-directory client cert list
(CVE-2026-29167)
[2.4.62-13.5]
- Resolves: RHEL-192752 - mod_proxy_html regression in CVE-2026-34355 fix
[2.4.62-13.4]
- Resolves: RHEL-186217 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)
- Resolves: RHEL-182578 - httpd: incomplete fix
for CVE-2023-38709 (CVE-2024-42516)
- Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-43951,
CVE-2026-44119, CVE-2026-44186
[2.4.62-13.3]
- Resolves: RHEL-186186 - httpd: mod_proxy_html buffer handling
vulnerability (CVE-2026-34355)
- Resolves: RHEL-175636 - httpd: mod_dav_lock uses wrong lock discovery
(CVE-2026-29169)
- Resolves: RHEL-186196 - mod_xml2enc: fix bblen accounting in fix_skipto
(CVE-2026-42536)
- Resolves: RHEL-186164 - httpd: fix OCSP write buffer advancement
bug in mod_ssl (CVE-2026-44185)
[2.4.62-13.2]
- Resolves: RHEL-184312 - httpd: ap_regname restrict to reasonable captures
(CVE-2026-44631)
[2.4.62-13.1]
- Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175080 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175100 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175028 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175062 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
Related CVEs
| CVE-2026-46729 |
| CVE-2026-48005 |
| CVE-2026-56153 |
| CVE-2026-56154 |
| CVE-2026-63045 |
| CVE-2026-63292 |
| CVE-2026-63686 |
| CVE-2026-63718 |
| CVE-2026-73636 |
| CVE-2026-73637 |
| CVE-2026-93546 |
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
| Oracle Linux 9 (aarch64) | httpd-2.4.62-13.0.1.el9_8.9.src.rpm | b0688f1f8aadd4a4d92eb82d1ce521e1d117f2f40d487d8c05f9cf814c8f4e6c | - | ol9_aarch64_appstream |
| httpd-2.4.62-13.0.1.el9_8.9.aarch64.rpm | 1edbd66558c94a0aaf55f5af5b7b0c4746be176c174e2f8faa8cbdf476820cee | - | ol9_aarch64_appstream | |
| httpd-core-2.4.62-13.0.1.el9_8.9.aarch64.rpm | 662a11fa13e118d142ef5472f52639cae23e4178469bb5ed4932f0aad67fbd64 | - | ol9_aarch64_appstream | |
| httpd-devel-2.4.62-13.0.1.el9_8.9.aarch64.rpm | fb01e62976a95c773cbf2f96a6297b5b062e112e3ab771e939c4f2601c24d5b0 | - | ol9_aarch64_appstream | |
| httpd-filesystem-2.4.62-13.0.1.el9_8.9.noarch.rpm | badb216ee81a422ecc9878bbdfc367f4390e46857af367a1c7df027fd1d9c9dc | - | ol9_aarch64_appstream | |
| httpd-manual-2.4.62-13.0.1.el9_8.9.noarch.rpm | 50eaa394b5378d64aa6e1041e234b56efb603b7d4b599a2e90315ea003a94065 | - | ol9_aarch64_appstream | |
| httpd-tools-2.4.62-13.0.1.el9_8.9.aarch64.rpm | b04560551f666b131032c2e74a9c0d32ab521d1489d061448075f853e005670d | - | ol9_aarch64_appstream | |
| mod_ldap-2.4.62-13.0.1.el9_8.9.aarch64.rpm | 8fe3a90edbc6d9e80829987286372ec1376222040b10828b3d3fed7de24d44bc | - | ol9_aarch64_appstream | |
| mod_lua-2.4.62-13.0.1.el9_8.9.aarch64.rpm | d638bbd25a502fa35ccf83ee78f140edeaaf0667b3eb6c390220185396e6f660 | - | ol9_aarch64_appstream | |
| mod_proxy_html-2.4.62-13.0.1.el9_8.9.aarch64.rpm | e2d22eb718d08d6e6a4d3938d8fcdbae5de884beaadf42ce44d7b9295a0cceaf | - | ol9_aarch64_appstream | |
| mod_session-2.4.62-13.0.1.el9_8.9.aarch64.rpm | 647e3dac00238e42d817d2c9a1064658c60b548269d064bd8b2372123f4cbc30 | - | ol9_aarch64_appstream | |
| mod_ssl-2.4.62-13.0.1.el9_8.9.aarch64.rpm | 64bb8de304236e99652df69fb13b2a53240beeaba5e1cc8693c22be45b30ff2f | - | ol9_aarch64_appstream | |
| Oracle Linux 9 (x86_64) | httpd-2.4.62-13.0.1.el9_8.9.src.rpm | b0688f1f8aadd4a4d92eb82d1ce521e1d117f2f40d487d8c05f9cf814c8f4e6c | - | ol9_x86_64_appstream |
| httpd-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 3d24db533e72ebc1c5a11e4cd3c5a4d440bae9df680e40cd7bafd00d17169945 | - | ol9_x86_64_appstream | |
| httpd-core-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 61f84218648edc2ef397ead9a2b8d14642a2de21a9047bd7f8c3079c1f82187a | - | ol9_x86_64_appstream | |
| httpd-devel-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 22e5e0e7a13ada2038764103d0f58e3cb5d0d1050ec8f767fe2ff820bf4fbcc5 | - | ol9_x86_64_appstream | |
| httpd-filesystem-2.4.62-13.0.1.el9_8.9.noarch.rpm | badb216ee81a422ecc9878bbdfc367f4390e46857af367a1c7df027fd1d9c9dc | - | ol9_x86_64_appstream | |
| httpd-manual-2.4.62-13.0.1.el9_8.9.noarch.rpm | 50eaa394b5378d64aa6e1041e234b56efb603b7d4b599a2e90315ea003a94065 | - | ol9_x86_64_appstream | |
| httpd-tools-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 642807c5eb6ba2a840ee51dbfffd8289f660b0186997199171eed6f1bf7171bd | - | ol9_x86_64_appstream | |
| mod_ldap-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 9fead35b6f1861cebe70027dba3c6024a7580b092e5e884698fb2a9d51aa370c | - | ol9_x86_64_appstream | |
| mod_lua-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 4c7525089d408e6c6ea61d6b84254e423f5ed379a01f68585d3f3301a16d4365 | - | ol9_x86_64_appstream | |
| mod_proxy_html-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 3c2b7d0d5ef7216ae66ceb189991c577eeee75ab380f17b32fa94d63a07b895f | - | ol9_x86_64_appstream | |
| mod_session-2.4.62-13.0.1.el9_8.9.x86_64.rpm | bf538ef11f06930b9a12837bb264dcac552f977b5982319d655e35054c93aae9 | - | ol9_x86_64_appstream | |
| mod_ssl-2.4.62-13.0.1.el9_8.9.x86_64.rpm | 283fc6aba57f778f5b8d99dc090aa0cd5745f8b9b8d3f7a6b760c38244d5b7de | - | ol9_x86_64_appstream | |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
