ELSA-2026-92616

ELSA-2026-92616 - httpd:2.4 security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-30

Description

httpd
[2.4.37-65.0.1.8]
- Replace index.html with Oracle's index page oracle_index.html

[2.4.37-65.8]
- Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp:
Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointer dereference can
cause a child process crash (CVE-2026-33007)
- Resolves: RHEL-175088 - httpd:2.4/httpd: off-by-one out-of-bounds reads
in AJP getter functions (CVE-2026-33857)
- Resolves: RHEL-175620 - httpd:2.4/httpd: NULL pointer dereference via
specially crafted request (CVE-2026-29169)
- Resolves: RHEL-175055 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)

mod_http2
mod_md
[1:2.0.8-8.4]
- Resolves: RHEL-251674 - fix segfault when await_valid times out and
prevent repeated CSR submission after restart

[1:2.0.8-8.3]
- Resolves: RHEL-247701 - fix CPU spikes from CVE-2025-55753 patch

Related CVEs

CVE-2026-33006

CVE-2026-46729

CVE-2026-48005

CVE-2026-56153

CVE-2026-56154

CVE-2026-63045

CVE-2026-63292

CVE-2026-63686

CVE-2026-63718

CVE-2026-73636

CVE-2026-73637

CVE-2026-93546

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	httpd-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.src.rpm	77e75cfcda40634915d70d380df2c2a5f93826795e099f12d4c63f3d2bf8d2eb	-	ol8_aarch64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+91023+3994037c.7.src.rpm	159e71f627b832b9189e19ac1a333c92ea743d1c30e54987d22a8d72a76287e4	-	ol8_aarch64_appstream
	mod_md-2.0.8-8.module+el8.10.0+91092+d4ec9ae3.4.src.rpm	32733f0c59d2292edba7c1f919a8ad16440a28d7b067e93ffafb3042ec952f13	-	ol8_aarch64_appstream
	httpd-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm	faed39805f04f41bf8bd6e9ce2b574d586856df0f787e0be9f3fe37bfc8d741c	-	ol8_aarch64_appstream
	httpd-devel-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm	d7b52918ec9bfacba7cde28ebdcfbbbe711f7ed10c99be3b64e6b9dd0b6366a0	-	ol8_aarch64_appstream
	httpd-filesystem-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm	a658cb9108616ee6a3ed374fc72a77e74566c8b034cc5eb4eabcb1c127775eec	-	ol8_aarch64_appstream
	httpd-manual-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm	93500a29425902ce0406a359388850276a42618d00d841719e0714512f7e5940	-	ol8_aarch64_appstream
	httpd-tools-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm	51f8acca21e768723343db2f36f0366e206db796ca78dd2cbdae4170c3ca7b47	-	ol8_aarch64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+91023+3994037c.7.aarch64.rpm	3e96774dab88f9bd4d089184a4874837c573189795181dbc0106c9d5f0cfbfd1	-	ol8_aarch64_appstream
	mod_ldap-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm	459965bd57abe505d0c6fe4e6333bb71a43e26ef9ec45dedaf6b8d1ee62f8f7a	-	ol8_aarch64_appstream
	mod_md-2.0.8-8.module+el8.10.0+91092+d4ec9ae3.4.aarch64.rpm	80e22ff45329b34226899f8db729de36e5ab4cbdee2851e3a6988aa9b6aef058	-	ol8_aarch64_appstream
	mod_proxy_html-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm	33f3086846caca13b6acba5ee93a402c3b6979b2bcec812eecc1efcdafa4b047	-	ol8_aarch64_appstream
	mod_session-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm	7c11d24d99e3298b64c7c1b5e350375c9d4dd1013f5bce5499d74478285dc75a	-	ol8_aarch64_appstream
	mod_ssl-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm	dcd7c88bd1c87824cafd1f09ab4281027b83da7d5754c54e56b1767ad2cbe0f8	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	httpd-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.src.rpm	77e75cfcda40634915d70d380df2c2a5f93826795e099f12d4c63f3d2bf8d2eb	-	ol8_x86_64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+91023+3994037c.7.src.rpm	159e71f627b832b9189e19ac1a333c92ea743d1c30e54987d22a8d72a76287e4	-	ol8_x86_64_appstream
	mod_md-2.0.8-8.module+el8.10.0+91092+d4ec9ae3.4.src.rpm	32733f0c59d2292edba7c1f919a8ad16440a28d7b067e93ffafb3042ec952f13	-	ol8_x86_64_appstream
	httpd-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm	e1232bd25a1296bb8fe8f8850cea13f616008dcd9f82388a142b25343b56ec34	-	ol8_x86_64_appstream
	httpd-devel-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm	e87dabcce627d1184af9466ea2df46c55e4c4a85767b99b12f1b4f162d443688	-	ol8_x86_64_appstream
	httpd-filesystem-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm	a658cb9108616ee6a3ed374fc72a77e74566c8b034cc5eb4eabcb1c127775eec	-	ol8_x86_64_appstream
	httpd-manual-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm	93500a29425902ce0406a359388850276a42618d00d841719e0714512f7e5940	-	ol8_x86_64_appstream
	httpd-tools-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm	4295c150ea8fed7c7e4c34a42c77a75b1388c3e339900bd83c09deeb76a7337e	-	ol8_x86_64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+91023+3994037c.7.x86_64.rpm	68581216c62017e49455014d6b6a5255ddd407646764ba901dbd9322c415c2eb	-	ol8_x86_64_appstream
	mod_ldap-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm	b7678b8eb46b854815ae826783840b6ae1a8506ac02d559a4fb70f3292d0e010	-	ol8_x86_64_appstream
	mod_md-2.0.8-8.module+el8.10.0+91092+d4ec9ae3.4.x86_64.rpm	fe7a2022ce2147c64efc166607add2bbac5a4e00af6c2eb885d789770d8a62b0	-	ol8_x86_64_appstream
	mod_proxy_html-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm	b8901bb21ecd0ea9c42d29fc9e26a33fb832e98d0c6b7225e7a34f90faf5a501	-	ol8_x86_64_appstream
	mod_session-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm	44308f6a2edd18631965623e3861b212b4b370c7ffcec1252d57b4a0e02e093d	-	ol8_x86_64_appstream
	mod_ssl-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm	a15246d2c26f942a49b5f2d2e0257f598031818b48bb96c56289dfeedbb7856b	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team