ELSA-2026-89860
- ULN >
- Oracle Linux Errata repository >
- ELSA-2026-89860
ELSA-2026-89860 - httpd security update
| Type: | SECURITY |
| Impact: | IMPORTANT |
| Release Date: | 2026-10-26 |
Description
[2.4.63-13.0.1.el10_2.8]
- Replace index.html with Oracle's index page oracle_index.html.
[2.4.63-13.8]
- Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host
header in mod_vhost_alias (CVE-2026-63292)
- Resolves: RHEL-280355 - httpd: Denial of Service via mod_rewrite
lookahead (CVE-2026-56154)
[2.4.63-13.7]
- Resolves: RHEL-275545 CVE-2026-48005 httpd: Denial of service via forged
Authorization headers in mod_auth_digest
- Resolves: RHEL-275331 CVE-2026-73636 httpd: Authentication bypass via
credential replay in mod_auth_digest
- Resolves: RHEL-275222 CVE-2026-73637 httpd: Authentication state corruption
via concurrent Digest authentication requests
- Resolves: RHEL-275315 CVE-2026-56153 httpd: Denial of Service via heap-based
buffer overflow in mod_charset_lite
- Resolves: RHEL-275302 CVE-2026-46729 httpd: mod_heartmonitor: Denial of
Service via NULL pointer dereference
- Resolves: RHEL-275269 CVE-2026-63045 httpd: unauthorized connection to
arbitrary hosts via crafted FTP PASV response
- Resolves: RHEL-275253 CVE-2026-63292 httpd: Arbitrary code execution via
oversized Host header in mod_vhost_alias
- Resolves: RHEL-275238 CVE-2026-63686 httpd: Denial of Service via charset
conversion failure in mod_xml2enc
- Resolves: RHEL-275208 CVE-2026-93546 httpd: Denial of Service via integer
overflow in mod_dav_fs
- Resolves: RHEL-275169 CVE-2026-63718 httpd: HTTP response smuggling via
crafted Transfer-Encoding response in mod_proxy_uwsgi
[2.4.63-13.6]
- Resolves: RHEL-190812 - httpd: Apache HTTP Server: Arbitrary code execution
or denial of service via use-after-free in mod_ldap per-directory
configuration (CVE-2026-29167)
[2.4.63-13.5]
- Resolves: RHEL-192750 - mod_proxy_html regression in CVE-2026-34355 fix
[2.4.63-13.4]
- Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)
- Resolves: RHEL-186195 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via untrusted content in mod_xml2enc (CVE-2026-42536)
- Resolves: RHEL-186182 - httpd: Apache HTTP Server: Buffer overflow in
mod_proxy_html allows security bypass (CVE-2026-34355)
- Resolves: RHEL-186158 - httpd: Apache HTTP Server: Buffer Over-read via
outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
- Resolves: RHEL-184305 - httpd: Apache HTTP Server: Denial of Service via
crafted regular expressions (CVE-2026-44631)
- Resolves : RHEL-182581 - httpd: incomplete fix for
CVE-2023-38709 (CVE-2024-42516)
- Resolves: RHEL-175621 - httpd: NULL pointer dereference via specially crafted
request (CVE-2026-29169)
- Also addresses CVE-2026-44119, CVE-2026-44186, CVE-2026-42535,
CVE-2026-24072, CVE-2026-33006, CVE-2026-43951
[2.4.63-13.1]
- Resolves: RHEL-173549 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175065 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175095 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175039 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175050 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
Related CVEs
| CVE-2026-46729 |
| CVE-2026-48005 |
| CVE-2026-56153 |
| CVE-2026-56154 |
| CVE-2026-63045 |
| CVE-2026-63292 |
| CVE-2026-63686 |
| CVE-2026-63718 |
| CVE-2026-73636 |
| CVE-2026-73637 |
| CVE-2026-93546 |
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
| Oracle Linux 10 (aarch64) | httpd-2.4.63-13.0.1.el10_2.8.src.rpm | 43342743f77d802ba5d63a6d6c3d83f91af860c410080e1075652d00362aa4cc | - | ol10_aarch64_appstream |
| httpd-2.4.63-13.0.1.el10_2.8.aarch64.rpm | 94bb224116c523106ae15778fc1a556871775d780e50cc96aa557d5dd3c4ac8f | - | ol10_aarch64_appstream | |
| httpd-core-2.4.63-13.0.1.el10_2.8.aarch64.rpm | 451503a01af450b34cf299132283ce0ff620ed804ee8111ccf1fa4bec93c148a | - | ol10_aarch64_appstream | |
| httpd-devel-2.4.63-13.0.1.el10_2.8.aarch64.rpm | fcad0a471b5ea03146599a3d1addc5bd5545ec1c973925551443585eaeaca3c8 | - | ol10_aarch64_appstream | |
| httpd-filesystem-2.4.63-13.0.1.el10_2.8.noarch.rpm | 008c7fb3df5bf79f56594140c0c5bd8bf6db9d06f034210fcfafa4cd37dfc96e | - | ol10_aarch64_appstream | |
| httpd-manual-2.4.63-13.0.1.el10_2.8.noarch.rpm | fc99899d170e83326b4047bb32593776dc86661dcdeb1dde91c45b6d2e25fe1b | - | ol10_aarch64_appstream | |
| httpd-tools-2.4.63-13.0.1.el10_2.8.aarch64.rpm | 9e3e1af6393b7a674e0f0dc1391a11251e6d362bc6da183c8865c81e1c77e94d | - | ol10_aarch64_appstream | |
| mod_ldap-2.4.63-13.0.1.el10_2.8.aarch64.rpm | a1ecb7b05e643cd3dfa25ba517b06024b5677a664273fb4649b81303aedfe2b5 | - | ol10_aarch64_appstream | |
| mod_lua-2.4.63-13.0.1.el10_2.8.aarch64.rpm | 99ce9f50b07368de0414e1c43b3505ec84fcbae2f7469a02c869507fb3b09f20 | - | ol10_aarch64_appstream | |
| mod_proxy_html-2.4.63-13.0.1.el10_2.8.aarch64.rpm | ec5aa6e33777640dd89502e4a342ea003b337037d84797cee6e067716aaffd6c | - | ol10_aarch64_appstream | |
| mod_session-2.4.63-13.0.1.el10_2.8.aarch64.rpm | c03fadad7e0a06ff085b02be34f6f5f0160d548da61933bb6b9229456ddc65d6 | - | ol10_aarch64_appstream | |
| mod_ssl-2.4.63-13.0.1.el10_2.8.aarch64.rpm | 0df60b9cfa09fc2eb87b2df0e16f226ba59633e62b6dbc948a9cf3f3553232af | - | ol10_aarch64_appstream | |
| Oracle Linux 10 (x86_64) | httpd-2.4.63-13.0.1.el10_2.8.src.rpm | 43342743f77d802ba5d63a6d6c3d83f91af860c410080e1075652d00362aa4cc | - | ol10_x86_64_appstream |
| httpd-2.4.63-13.0.1.el10_2.8.x86_64.rpm | 2cce8a2ddf996ac0c848cab3e07853bb7af7a32895b45a84749fe6765ed18224 | - | ol10_x86_64_appstream | |
| httpd-core-2.4.63-13.0.1.el10_2.8.x86_64.rpm | 6446160a0f2cf943bc72ee479d43ae8c33472b38327cf7f6ada396b78d6420ce | - | ol10_x86_64_appstream | |
| httpd-devel-2.4.63-13.0.1.el10_2.8.x86_64.rpm | a445e3da848aa8b23580779aaa1f37221ecd2f35503758f478006da772a5eb03 | - | ol10_x86_64_appstream | |
| httpd-filesystem-2.4.63-13.0.1.el10_2.8.noarch.rpm | 008c7fb3df5bf79f56594140c0c5bd8bf6db9d06f034210fcfafa4cd37dfc96e | - | ol10_x86_64_appstream | |
| httpd-manual-2.4.63-13.0.1.el10_2.8.noarch.rpm | fc99899d170e83326b4047bb32593776dc86661dcdeb1dde91c45b6d2e25fe1b | - | ol10_x86_64_appstream | |
| httpd-tools-2.4.63-13.0.1.el10_2.8.x86_64.rpm | 694a7641b4abe3c5d077bffa725af27c56967f7ebdfe0feba0eb1b6292bd67b6 | - | ol10_x86_64_appstream | |
| mod_ldap-2.4.63-13.0.1.el10_2.8.x86_64.rpm | 29878752e67aa98c519101ba531bb4bd887fdca80b0c0ac68daaa5625d83013d | - | ol10_x86_64_appstream | |
| mod_lua-2.4.63-13.0.1.el10_2.8.x86_64.rpm | bea57281b888a88f90026e8c72b1491e3435c2d55104c20074908948f0872cd8 | - | ol10_x86_64_appstream | |
| mod_proxy_html-2.4.63-13.0.1.el10_2.8.x86_64.rpm | e85a511863bfa7872c2474d9dfb7bac7087277aa1a29c0b0223eea2601974895 | - | ol10_x86_64_appstream | |
| mod_session-2.4.63-13.0.1.el10_2.8.x86_64.rpm | 32c8b5c8585f4c3bbcc9e84c38b152c79acf10ca1a183df48ade9e2726124c8c | - | ol10_x86_64_appstream | |
| mod_ssl-2.4.63-13.0.1.el10_2.8.x86_64.rpm | b5e72ac5d79f88be2c970ebd96ebd28ecf8820ccbe8c685151043cde8e7c0acd | - | ol10_x86_64_appstream | |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
