RHSA-2026:74858

Vulnerability from csaf_redhat - Published: 2026-10-02 09:04 - Updated: 2026-10-02 12:08
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: httpd: * httpd-2.4.69-1.hum1 (aarch64, x86_64) * httpd-core-2.4.69-1.hum1 (aarch64, x86_64) * httpd-devel-2.4.69-1.hum1 (aarch64, x86_64) * httpd-filesystem-2.4.69-1.hum1 (noarch) * httpd-manual-2.4.69-1.hum1 (noarch) * httpd-tools-2.4.69-1.hum1 (aarch64, x86_64) * mod_ldap-2.4.69-1.hum1 (aarch64, x86_64) * mod_lua-2.4.69-1.hum1 (aarch64, x86_64) * mod_proxy_html-2.4.69-1.hum1 (aarch64, x86_64) * mod_session-2.4.69-1.hum1 (aarch64, x86_64) * mod_ssl-2.4.69-1.hum1 (aarch64, x86_64) * httpd-2.4.69-1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-42356

A flaw was found in Apache HTTP Server. An attacker could achieve unintended code execution when an internal redirect generated by a Common Gateway Interface (CGI) program points to a non-executable file. If the target file resides in a directory configured for CGI execution and lacks a file extension recognized by the MIME handler, the server incorrectly treats and executes the target file as a script. This issue could allow an attacker to run unauthorized commands or code within the server context.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-430 - Deployment of Wrong Handler
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Low
CVE-2026-42528

A flaw was found in the mod_dav module of the Apache HTTP Server. This vulnerability allows a Denial of Service (DoS) by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning (WebDAV) locks can trigger a memory calculation error during lock operations, terminating active server processes.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Moderate
CVE-2026-46729

A flaw was found in the mod_heartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attacker can crash the server process, resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Important
CVE-2026-47360

A flaw was found in Apache HTTP Server's mod_session_cookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session tokens to backend servers.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Low
CVE-2026-48005

A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) condition by disrupting valid sessions and repeatedly forcing legitimate users to re-authenticate.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-303 - Incorrect Implementation of Authentication Algorithm
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Low
CVE-2026-56153

A flaw was found in httpd's mod_charset_lite module. A heap-based buffer overflow (an out-of-bounds memory write) occurs in the finish_partial_char function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory corruption. This issue primarily results in a Denial of Service (DoS) condition by crashing the server process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Important
CVE-2026-56449

A flaw was found in the mod_proxy_html module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service (DoS).

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Low
CVE-2026-58415

A flaw was found in the mod_dav_fs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV (Web Distributed Authoring and Versioning) state directory. This allows unauthorized access to internal state files, resulting in information disclosure of stored resource metadata and properties.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-552 - Files or Directories Accessible to External Parties
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Moderate
CVE-2026-63045

A flaw was found in httpd. When configured as a forward proxy using the mod_proxy_ftp module, the server improperly validates the network address returned in a File Transfer Protocol (FTP) passive mode (PASV) response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing the proxy to establish a data connection to an arbitrary third-party host. This issue may allow an attacker to initiate unauthorized network connections or probe internal systems that are otherwise inaccessible.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Moderate
CVE-2026-63292

A flaw was found in httpd's mod_vhost_alias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the web server.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Important
CVE-2026-63686

A flaw was found in the mod_xml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service (DoS) by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access (null pointer dereference), causing the server process to crash.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Important
CVE-2026-63718

A flaw was found in the mod_proxy_uwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentially leading to response tampering or cache poisoning for other users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Important
CVE-2026-73636

A flaw was found in the mod_auth_digest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce (a single-use security token) lifetime of zero, an attacker can send crafted requests that prematurely clear the client session entry from shared memory, enabling unauthorized access using the replayed credentials.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-294 - Authentication Bypass by Capture-replay
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Important
CVE-2026-73637

A flaw was found in httpd's mod_auth_digest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce checking (AuthDigestNcCheck) or zero-duration nonce lifetimes (AuthDigestNonceLifetime), are enabled.

5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Moderate
CVE-2026-79768

A flaw was found in Apache HTTP Server's mod_userdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory ('/./') path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP request, potentially bypassing path restrictions to access unauthorized files, leading to information disclosure.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-41 - Improper Resolution of Path Equivalence
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Moderate
CVE-2026-93546

A flaw was found in httpd. An integer overflow in the mod_dav_fs module occurs when processing Web Distributed Authoring and Versioning (WebDAV) PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash server worker processes, causing a Denial of Service (DoS), and persistently corrupt the directory's property database.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 23 products, the same list as for CVE-2026-42356
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:74858 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-47360 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2026-42356 external
https://access.redhat.com/security/cve/CVE-2026-48005 external
https://access.redhat.com/security/cve/CVE-2026-73636 external
https://access.redhat.com/security/cve/CVE-2026-58415 external
https://access.redhat.com/security/cve/CVE-2026-56153 external
https://access.redhat.com/security/cve/CVE-2026-46729 external
https://access.redhat.com/security/cve/CVE-2026-63045 external
https://access.redhat.com/security/cve/CVE-2026-63292 external
https://access.redhat.com/security/cve/CVE-2026-42528 external
https://access.redhat.com/security/cve/CVE-2026-63686 external
https://access.redhat.com/security/cve/CVE-2026-73637 external
https://access.redhat.com/security/cve/CVE-2026-93546 external
https://access.redhat.com/security/cve/CVE-2026-56449 external
https://access.redhat.com/security/cve/CVE-2026-79768 external
https://access.redhat.com/security/cve/CVE-2026-63718 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-42356 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544825 external
https://www.cve.org/CVERecord?id=CVE-2026-42356 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42356 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://httpd.apache.org/security/vulnerabilities… external
https://access.redhat.com/security/cve/CVE-2026-42528 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544828 external
https://www.cve.org/CVERecord?id=CVE-2026-42528 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42528 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-46729 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544835 external
https://www.cve.org/CVERecord?id=CVE-2026-46729 external
https://nvd.nist.gov/vuln/detail/CVE-2026-46729 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-47360 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544884 external
https://www.cve.org/CVERecord?id=CVE-2026-47360 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47360 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-48005 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544861 external
https://www.cve.org/CVERecord?id=CVE-2026-48005 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48005 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-56153 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544885 external
https://www.cve.org/CVERecord?id=CVE-2026-56153 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56153 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-56449 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544778 external
https://www.cve.org/CVERecord?id=CVE-2026-56449 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56449 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-58415 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544804 external
https://www.cve.org/CVERecord?id=CVE-2026-58415 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58415 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-63045 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544823 external
https://www.cve.org/CVERecord?id=CVE-2026-63045 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63045 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-63292 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544832 external
https://www.cve.org/CVERecord?id=CVE-2026-63292 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63292 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-63686 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544852 external
https://www.cve.org/CVERecord?id=CVE-2026-63686 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63686 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-63718 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544781 external
https://www.cve.org/CVERecord?id=CVE-2026-63718 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63718 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-73636 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544849 external
https://www.cve.org/CVERecord?id=CVE-2026-73636 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73636 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-73637 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544814 external
https://www.cve.org/CVERecord?id=CVE-2026-73637 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73637 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-79768 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544783 external
https://www.cve.org/CVERecord?id=CVE-2026-79768 external
https://nvd.nist.gov/vuln/detail/CVE-2026-79768 external
http://www.openwall.com/lists/oss-security/2026/1… external
https://access.redhat.com/security/cve/CVE-2026-93546 self
https://bugzilla.redhat.com/show_bug.cgi?id=2544798 external
https://www.cve.org/CVERecord?id=CVE-2026-93546 external
https://nvd.nist.gov/vuln/detail/CVE-2026-93546 external
http://www.openwall.com/lists/oss-security/2026/1… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nhttpd:\n  * httpd-2.4.69-1.hum1 (aarch64, x86_64)\n  * httpd-core-2.4.69-1.hum1 (aarch64, x86_64)\n  * httpd-devel-2.4.69-1.hum1 (aarch64, x86_64)\n  * httpd-filesystem-2.4.69-1.hum1 (noarch)\n  * httpd-manual-2.4.69-1.hum1 (noarch)\n  * httpd-tools-2.4.69-1.hum1 (aarch64, x86_64)\n  * mod_ldap-2.4.69-1.hum1 (aarch64, x86_64)\n  * mod_lua-2.4.69-1.hum1 (aarch64, x86_64)\n  * mod_proxy_html-2.4.69-1.hum1 (aarch64, x86_64)\n  * mod_session-2.4.69-1.hum1 (aarch64, x86_64)\n  * mod_ssl-2.4.69-1.hum1 (aarch64, x86_64)\n  * httpd-2.4.69-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:74858",
        "url": "https://access.redhat.com/errata/RHSA-2026:74858"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-47360",
        "url": "https://access.redhat.com/security/cve/CVE-2026-47360"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42356",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42356"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48005",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48005"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73636",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73636"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58415",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58415"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56153",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56153"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-46729",
        "url": "https://access.redhat.com/security/cve/CVE-2026-46729"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-63045",
        "url": "https://access.redhat.com/security/cve/CVE-2026-63045"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-63292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-63292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42528",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42528"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-63686",
        "url": "https://access.redhat.com/security/cve/CVE-2026-63686"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73637",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73637"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93546",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93546"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56449",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56449"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-79768",
        "url": "https://access.redhat.com/security/cve/CVE-2026-79768"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-63718",
        "url": "https://access.redhat.com/security/cve/CVE-2026-63718"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74858.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-02T12:08:26+00:00",
      "generator": {
        "date": "2026-10-02T12:08:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:74858",
      "initial_release_date": "2026-10-02T09:04:53+00:00",
      "revision_history": [
        {
          "date": "2026-10-02T09:04:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-02T09:41:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-02T12:08:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "httpd-0:2.4.69-1.hum1@aarch64",
                  "product_id": "httpd-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "httpd-core-0:2.4.69-1.hum1@aarch64",
                  "product_id": "httpd-core-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "httpd-devel-0:2.4.69-1.hum1@aarch64",
                  "product_id": "httpd-devel-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-devel@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "httpd-tools-0:2.4.69-1.hum1@aarch64",
                  "product_id": "httpd-tools-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "mod_ldap-0:2.4.69-1.hum1@aarch64",
                  "product_id": "mod_ldap-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "mod_lua-0:2.4.69-1.hum1@aarch64",
                  "product_id": "mod_lua-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "mod_proxy_html-0:2.4.69-1.hum1@aarch64",
                  "product_id": "mod_proxy_html-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "mod_session-0:2.4.69-1.hum1@aarch64",
                  "product_id": "mod_session-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-0:2.4.69-1.hum1@aarch64",
                "product": {
                  "name": "mod_ssl-0:2.4.69-1.hum1@aarch64",
                  "product_id": "mod_ssl-0:2.4.69-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl@2.4.69-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.69-1.hum1@src",
                "product": {
                  "name": "httpd-0:2.4.69-1.hum1@src",
                  "product_id": "httpd-0:2.4.69-1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.69-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "httpd-0:2.4.69-1.hum1@x86_64",
                  "product_id": "httpd-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "httpd-core-0:2.4.69-1.hum1@x86_64",
                  "product_id": "httpd-core-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "httpd-devel-0:2.4.69-1.hum1@x86_64",
                  "product_id": "httpd-devel-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-devel@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "httpd-tools-0:2.4.69-1.hum1@x86_64",
                  "product_id": "httpd-tools-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "mod_ldap-0:2.4.69-1.hum1@x86_64",
                  "product_id": "mod_ldap-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "mod_lua-0:2.4.69-1.hum1@x86_64",
                  "product_id": "mod_lua-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "mod_proxy_html-0:2.4.69-1.hum1@x86_64",
                  "product_id": "mod_proxy_html-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "mod_session-0:2.4.69-1.hum1@x86_64",
                  "product_id": "mod_session-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-0:2.4.69-1.hum1@x86_64",
                "product": {
                  "name": "mod_ssl-0:2.4.69-1.hum1@x86_64",
                  "product_id": "mod_ssl-0:2.4.69-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl@2.4.69-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-filesystem@2.4.69-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-filesystem@2.4.69-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-manual@2.4.69-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-manual@2.4.69-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "httpd-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.69-1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src"
        },
        "product_reference": "httpd-0:2.4.69-1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "httpd-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "httpd-core-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "httpd-core-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "httpd-devel-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "httpd-devel-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "httpd-tools-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "httpd-tools-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "mod_ldap-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "mod_ldap-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "mod_lua-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "mod_lua-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "mod_proxy_html-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "mod_proxy_html-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "mod_session-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "mod_session-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-0:2.4.69-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64"
        },
        "product_reference": "mod_ssl-0:2.4.69-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-0:2.4.69-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        },
        "product_reference": "mod_ssl-0:2.4.69-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42356",
      "cwe": {
        "id": "CWE-430",
        "name": "Deployment of Wrong Handler"
      },
      "discovery_date": "2026-10-01T23:06:06.846506+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. An attacker could achieve unintended code execution when an internal redirect generated by a Common Gateway Interface (CGI) program points to a non-executable file. If the target file resides in a directory configured for CGI execution and lacks a file extension recognized by the MIME handler, the server incorrectly treats and executes the target file as a script. This issue could allow an attacker to run unauthorized commands or code within the server context.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: arbitrary code execution via incorrect handler assignment during internal CGI redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42356"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42356",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42356"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42356",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42356"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/11",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/11"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T15:54:35.649000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "If CGI functionality is not required, disable CGI execution by commenting out `mod_cgi` or `mod_cgid` in the Apache configuration (for example, in `/etc/httpd/conf.modules.d/01-cgi.conf`), or by removing `ExecCGI` from `Options` directives in `/etc/httpd/conf/httpd.conf`.\n\nApply the changes to the running service:\nsystemctl reload httpd\n\nCaveats: Disabling CGI modules or execution options will prevent any existing CGI applications from functioning.\n\nWarning: Reloading or restarting the httpd service may temporarily disrupt active connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: httpd: arbitrary code execution via incorrect handler assignment during internal CGI redirects"
    },
    {
      "cve": "CVE-2026-42528",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-10-01T23:06:22.149635+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544828"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_dav module of the Apache HTTP Server. This vulnerability allows a Denial of Service (DoS) by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning (WebDAV) locks can trigger a memory calculation error during lock operations, terminating active server processes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42528"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544828",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544828"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42528",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42528"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42528",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42528"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/12",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/12"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T15:52:51.682000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "If WebDAV functionality is not required, disable the mod_dav module by commenting out the `LoadModule dav_module` line in `/etc/httpd/conf.modules.d/00-dav.conf` or setting `Dav Off` within the relevant configuration contexts.\n\nIf WebDAV is required, restrict lock capabilities to authenticated and trusted clients by limiting the LOCK method within the configuration (for example, using `\u003cLimit LOCK\u003e` blocks with strict `Require` directives).\n\nApply configuration changes by reloading the service:\n```\nsystemctl reload httpd\n```\n\nWarning: Disabling mod_dav or restricting lock operations will prevent WebDAV clients from acquiring shared or exclusive resource locks. Reloading the httpd service may briefly affect active HTTP connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error"
    },
    {
      "cve": "CVE-2026-46729",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-01T23:07:14.331403+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544835"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_heartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attacker can crash the server process, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46729"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544835",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544835"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46729",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46729"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46729",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46729"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/13",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/13"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T15:55:27.083000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "Disable the mod_heartmonitor module or restrict network access to the monitoring port:\n\n1. Disable the module:\nComment out the LoadModule directive for mod_heartmonitor in the Apache configuration (typically located in `/etc/httpd/conf.modules.d/00-base.conf` or a custom configuration file):\n# LoadModule heartmonitor_module modules/mod_heartmonitor.so\n\nThen reload the web server configuration:\nsystemctl reload httpd\n\n2. Restrict network reachability:\nIf mod_heartmonitor is required, configure firewall rules using firewalld to permit traffic to the HeartbeatListen unicast port only from authorized backend nodes:\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_RANGE\u003e\nfirewall-cmd --reload\n\nCaveat: Disabling mod_heartmonitor prevents mod_lbmethod_heartbeat from receiving backend node status, which disables heartbeat-based dynamic load balancing.\n\nWarning: Modifying Apache configuration files requires reloading or restarting httpd, which may briefly interrupt active network connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference"
    },
    {
      "cve": "CVE-2026-47360",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2026-10-01T23:12:09.963829+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544884"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server\u0027s mod_session_cookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session tokens to backend servers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Information disclosure via session cookie leakage during internal redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47360"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544884",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544884"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47360",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47360"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47360",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47360"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/14",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/14"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:00:51.682000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "If cookie-based session management is not required, disable the `mod_session_cookie` module.\n\n1. Comment out the module load directive in `/etc/httpd/conf.modules.d/01-session.conf` (or the relevant configuration file):\n```\n# LoadModule session_cookie_module modules/mod_session_cookie.so\n```\n\n2. Reload the `httpd` service to apply the configuration:\n```\nsystemctl reload httpd\n```\n\nWarning: Reloading or restarting the `httpd` service may briefly interrupt active network connections. Additionally, disabling this module will cause any web server configurations or web applications relying on `mod_session_cookie` to fail.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: httpd: Information disclosure via session cookie leakage during internal redirects"
    },
    {
      "cve": "CVE-2026-48005",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-10-01T23:10:15.030167+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544861"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) condition by disrupting valid sessions and repeatedly forcing legitimate users to re-authenticate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48005"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544861",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544861"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48005",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48005"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48005",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48005"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/15",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/15"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:01:35.559000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable nonce-count verification by setting `AuthDigestNcCheck Off` within the relevant configuration context in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`:\n\nAuthDigestNcCheck Off\n\nAlternatively, if Digest authentication is not required, disable `mod_auth_digest` by commenting out the corresponding `LoadModule auth_digest_module` line in `/etc/httpd/conf.modules.d/00-base.conf`.\n\nAfter modifying the configuration, reload the service:\n\nsystemctl reload httpd\n\nCaveats: Disabling `AuthDigestNcCheck` removes server-side nonce-count checking, reducing replay protection for Digest authentication.\n\nWarning: Reloading the httpd service can momentarily disrupt in-flight connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest"
    },
    {
      "cve": "CVE-2026-56153",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-01T23:12:13.148592+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544885"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in httpd\u0027s mod_charset_lite module. A heap-based buffer overflow (an out-of-bounds memory write) occurs in the finish_partial_char function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory corruption. This issue primarily results in a Denial of Service (DoS) condition by crashing the server process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544885",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544885"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56153"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/16",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/16"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:03:25.568000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "Disable the mod_charset_lite module if character set translation is not required.\n\n1. Locate the configuration file loading the module, typically within `/etc/httpd/conf.modules.d/` (such as `00-base.conf` or a dedicated module configuration file).\n2. Comment out or remove the `LoadModule charset_lite_module` line:\n```\n# LoadModule charset_lite_module modules/mod_charset_lite.so\n```\n3. Reload the httpd service to apply the configuration change:\n```\nsystemctl reload httpd\n```\n\nCaveats: Applications that depend on mod_charset_lite for on-the-fly character set conversion will fail to translate character sets once the module is disabled.\n\nWarning: Reloading or restarting the httpd service will momentarily disrupt active network connections or in-flight requests.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite"
    },
    {
      "cve": "CVE-2026-56449",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-01T22:25:59.649759+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544778"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_html module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Denial of Service via crafted HTTP response bodies in mod_proxy_html",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56449"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544778",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544778"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56449",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56449"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56449",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56449"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/18",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/18"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:06:24.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "Disable the `mod_proxy_html` module if HTML link rewriting is not required:\n\n1. Comment out the module loader directive in `/etc/httpd/conf.modules.d/00-proxyhtml.conf`:\n```\n# sed -i \u0027s/^\\s*LoadModule proxy_html_module/#\u0026/\u0027 /etc/httpd/conf.modules.d/00-proxyhtml.conf\n```\nAlternatively, set `ProxyHTMLEnable Off` in the affected server or virtual host configuration.\n\n2. Reload the Apache HTTP Server:\n```\n# systemctl reload httpd\n```\n\nCaveats:\nDisabling `mod_proxy_html` or turning off `ProxyHTMLEnable` halts automated rewriting of URLs in proxied HTML responses, which may break web applications that depend on backend path translation.\n\nWarning: Reloading or restarting the `httpd` service may temporarily interrupt active network connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: httpd: Denial of Service via crafted HTTP response bodies in mod_proxy_html"
    },
    {
      "cve": "CVE-2026-58415",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2026-10-01T22:49:49.180151+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544804"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_dav_fs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV (Web Distributed Authoring and Versioning) state directory. This allows unauthorized access to internal state files, resulting in information disclosure of stored resource metadata and properties.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Information disclosure via direct request to the WebDAV state directory",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58415"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544804",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544804"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58415",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58415"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58415",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58415"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/20",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/20"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:07:20.338000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, block direct HTTP requests to the internal WebDAV state directory, or disable the mod_dav_fs module if WebDAV functionality is not required.\n\n1. Block access to the .DAV directory:\nCreate or edit a configuration snippet, such as `/etc/httpd/conf.d/block-dav-state.conf`, with the following directive:\n\n\u003cLocationMatch \"(^|/)\\.DAV\"\u003e\n    Require all denied\n\u003c/LocationMatch\u003e\n\n2. Alternatively, disable the module if WebDAV is not used:\nComment out the following line in `/etc/httpd/conf.modules.d/00-dav.conf`:\n# LoadModule dav_fs_module modules/mod_dav_fs.so\n\n3. Apply changes:\nVerify the configuration syntax:\n# apachectl configtest\n\nReload the service:\n# systemctl reload httpd\n\nWarning: Reloading or restarting httpd will impact active network connections. Ensure configuration syntax is validated before reloading to avoid service interruption. Disabling mod_dav_fs will stop all WebDAV filesystem storage operations.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: httpd: Information disclosure via direct request to the WebDAV state directory"
    },
    {
      "cve": "CVE-2026-63045",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-10-01T23:05:56.978362+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in httpd. When configured as a forward proxy using the mod_proxy_ftp module, the server improperly validates the network address returned in a File Transfer Protocol (FTP) passive mode (PASV) response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing the proxy to establish a data connection to an arbitrary third-party host. This issue may allow an attacker to initiate unauthorized network connections or probe internal systems that are otherwise inaccessible.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63045"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63045",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63045"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63045",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63045"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/23",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/23"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:09:07.643000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "Disable the mod_proxy_ftp module or ensure forward proxying is disabled in the Apache HTTP Server configuration.\n\n1. Comment out the mod_proxy_ftp module load line in `/etc/httpd/conf.modules.d/00-proxy.conf`:\n```\n# LoadModule proxy_ftp_module modules/mod_proxy_ftp.so\n```\n\n2. Ensure forward proxying is turned off in `/etc/httpd/conf/httpd.conf`:\n```\nProxyRequests Off\n```\n\n3. Reload the httpd service to apply changes:\n```\nsystemctl reload httpd\n```\n\nCaveat: Disabling mod_proxy_ftp terminates the ability of httpd to proxy FTP requests.\nWarning: Reloading or restarting the httpd service will briefly affect active connections while configuration changes are reloaded.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response"
    },
    {
      "cve": "CVE-2026-63292",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-01T23:06:53.740525+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544832"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in httpd\u0027s mod_vhost_alias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the web server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544832",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544832"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63292"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/24",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/24"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:11:47.911000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability without code modifications, ensure that `LimitRequestFieldSize` remains at or below its default limit of 8190 bytes, or disable the `mod_vhost_alias` module if dynamic virtual hosting is not required.\n\n1. Ensure `LimitRequestFieldSize` is not configured above 8190 in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`:\n```\nLimitRequestFieldSize 8190\n```\n\n2. Alternatively, if `mod_vhost_alias` is not needed, disable it by commenting out its loading directive in `/etc/httpd/conf.modules.d/00-base.conf`:\n```\n# LoadModule vhost_alias_module modules/mod_vhost_alias.so\n```\n\n3. Validate the configuration syntax and reload the service:\n```\napachectl configtest\nsystemctl reload httpd\n```\n\nCaveats: Restricting `LimitRequestFieldSize` may reject legitimate requests that carry exceptionally large HTTP headers, returning a 400 Bad Request response. Disabling `mod_vhost_alias` prevents the use of dynamic virtual host directives such as `VirtualDocumentRoot`.\n\nWarning: Reloading or restarting the `httpd` daemon may briefly affect in-flight network connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias"
    },
    {
      "cve": "CVE-2026-63686",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-01T23:09:03.782806+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544852"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_xml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service (DoS) by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access (null pointer dereference), causing the server process to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63686"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544852",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544852"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63686",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63686"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63686",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63686"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/25",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/25"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:20:14.360000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "If proxy character set transcoding is not required, disable the mod_xml2enc module by commenting out its configuration directive.\n\n1. Edit the module configuration file (typically located under `/etc/httpd/conf.modules.d/`) and comment out the loading directive:\n   # LoadModule xml2enc_module modules/mod_xml2enc.so\n\n2. Verify the configuration syntax:\n   httpd -t\n\n3. Reload the Apache HTTP Server to apply changes:\n   systemctl reload httpd\n\nCaveats: Disabling mod_xml2enc will break modules that depend on XML or HTML character set conversion, such as mod_proxy_html. If this module is required, restrict proxy rules so httpd communicates only with trusted upstream backends.\n\nWarning: Reloading or restarting the httpd service may cause a brief interruption to active connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc"
    },
    {
      "cve": "CVE-2026-63718",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-01T22:29:59.448690+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544781"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_uwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentially leading to response tampering or cache poisoning for other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63718"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544781",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544781"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63718"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/26",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/26"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:17:06.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "If uWSGI proxy functionality is not required, disable the mod_proxy_uwsgi module:\n\n1. Edit the Apache proxy module configuration file (typically `/etc/httpd/conf.modules.d/00-proxy.conf`) and comment out the loading directive:\n   # LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so\n\n2. Restart the Apache HTTP Server daemon:\n   systemctl restart httpd\n\nWarning: Restarting the httpd service causes an immediate disruption to active client connections. Disabling this module will prevent the server from handling requests routed through the uWSGI protocol.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi"
    },
    {
      "cve": "CVE-2026-73636",
      "cwe": {
        "id": "CWE-294",
        "name": "Authentication Bypass by Capture-replay"
      },
      "discovery_date": "2026-10-01T23:08:47.276061+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_auth_digest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce (a single-use security token) lifetime of zero, an attacker can send crafted requests that prematurely clear the client session entry from shared memory, enabling unauthorized access using the replayed credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Authentication bypass via credential replay in mod_auth_digest",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73636"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73636",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73636"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73636",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73636"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/27",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/27"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:17:59.618000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "Ensure that `AuthDigestNonceLifetime` is not set to `0`. If digest authentication is not required, disable `mod_auth_digest`.\n\n1. To retain digest authentication with safe settings, set a positive non-zero value (such as the default 300 seconds) or remove the explicit zero setting from `/etc/httpd/conf/httpd.conf` or relevant files in `/etc/httpd/conf.d/`:\n```\nAuthDigestNonceLifetime 300\n```\n\n2. If HTTP digest authentication is not needed, disable the module by commenting out the corresponding line in `/etc/httpd/conf.modules.d/00-base.conf`:\n```\n#LoadModule auth_digest_module modules/mod_auth_digest.so\n```\n\n3. Restart the web server to apply changes:\n```\nsystemctl restart httpd\n```\n\nWarning: Restarting or reloading the httpd service will briefly disrupt active client connections. Disabling the module will break authentication for virtual hosts or directories relying on digest authentication.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: httpd: Authentication bypass via credential replay in mod_auth_digest"
    },
    {
      "cve": "CVE-2026-73637",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-10-01T23:01:30.310347+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544814"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in httpd\u0027s mod_auth_digest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server\u0027s authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce checking (AuthDigestNcCheck) or zero-duration nonce lifetimes (AuthDigestNonceLifetime), are enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Authentication state corruption via concurrent Digest authentication requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73637"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544814",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544814"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73637",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73637"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73637",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73637"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/28",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/28"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:18:30.190000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, apply one of the following configuration options:\n\n1. Disable `mod_auth_digest` if Digest authentication is not required:\nIn `/etc/httpd/conf.modules.d/00-base.conf` (or the relevant module configuration file), comment out the loading of the module:\n```\n# LoadModule auth_digest_module modules/mod_auth_digest.so\n```\n\n2. If Digest authentication is required, ensure vulnerable settings are disabled:\nEnsure `AuthDigestNcCheck` is set to `Off` (or removed, as `Off` is the default) and ensure `AuthDigestNonceLifetime` is not set to `0` (the default value is 300 seconds).\n\nAfter applying configuration adjustments, reload the web server:\n```\nsystemctl reload httpd\n```\n\nWarning: Reloading or restarting the `httpd` service may briefly disrupt active client connections. Disabling `mod_auth_digest` will cause authentication failures for resources configured with `AuthType Digest`.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: httpd: Authentication state corruption via concurrent Digest authentication requests"
    },
    {
      "cve": "CVE-2026-79768",
      "cwe": {
        "id": "CWE-41",
        "name": "Improper Resolution of Path Equivalence"
      },
      "discovery_date": "2026-10-01T22:33:26.344458+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server\u0027s mod_userdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory (\u0027/./\u0027) path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP request, potentially bypassing path restrictions to access unauthorized files, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-79768"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-79768",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-79768"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79768",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79768"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/29",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/29"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:18:57.661000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "Disable user directories or avoid configuring absolute directory paths without wildcards in the `UserDir` directive.\n\n1. If per-user web directories are not required, ensure `UserDir disabled` is configured in `/etc/httpd/conf.d/userdir.conf`, or comment out the module loading directive:\n```\n# LoadModule userdir_module modules/mod_userdir.so\n```\n\n2. If user directories are necessary, configure `UserDir` using a relative path (for example, `UserDir public_html`) rather than an absolute path.\n\n3. Reload the Apache HTTP Server configuration to apply changes:\n```\nsystemctl reload httpd\n```\n\nCaveats: Disabling mod_userdir prevents users from publishing content via `~username` URLs. Reloading the httpd service may briefly affect active HTTP connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence"
    },
    {
      "cve": "CVE-2026-93546",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-10-01T22:44:48.492068+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2544798"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in httpd. An integer overflow in the mod_dav_fs module occurs when processing Web Distributed Authoring and Versioning (WebDAV) PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash server worker processes, causing a Denial of Service (DoS), and persistently corrupt the directory\u0027s property database.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: Denial of Service via integer overflow in mod_dav_fs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
          "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
          "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2544798",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544798"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93546"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/30",
          "url": "http://www.openwall.com/lists/oss-security/2026/10/01/30"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-10-01T16:19:32.662000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-02T09:04:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74858"
        },
        {
          "category": "workaround",
          "details": "If WebDAV capabilities are not required, disable the `mod_dav_fs` module:\n\n1. Comment out the `dav_fs_module` directive in `/etc/httpd/conf.modules.d/00-dav.conf`:\n```\n#LoadModule dav_fs_module modules/mod_dav_fs.so\n```\n\nAlternatively, if WebDAV is required but property modifications can be restricted, block the `PROPPATCH` method in the affected `\u003cDirectory\u003e` or `\u003cLocation\u003e` configuration block:\n```apache\n\u003cLocation \"/webdav\"\u003e\n    \u003cLimit PROPPATCH\u003e\n        Require all denied\n    \u003c/Limit\u003e\n\u003c/Location\u003e\n```\n\n2. Apply the configuration changes:\n```\nsystemctl reload httpd\n```\n\nCaveats:\nDisabling `mod_dav_fs` disables file-backed WebDAV shares across the server. Blocking `PROPPATCH` prevents clients from manipulating WebDAV dead properties.\n\nWarning: Reloading or restarting the `httpd` service will temporarily impact active client connections.",
          "product_ids": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@src",
            "Red Hat Hardened Images:httpd-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-core-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-devel-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-filesystem-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:httpd-manual-0:2.4.69-1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:httpd-tools-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ldap-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_lua-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_proxy_html-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_session-0:2.4.69-1.hum1@x86_64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@aarch64",
            "Red Hat Hardened Images:mod_ssl-0:2.4.69-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: httpd: Denial of Service via integer overflow in mod_dav_fs"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.