Vulnerability-Lookup

RHSA-2026:66323

Vulnerability from csaf_redhat - Published: 2026-09-10 06:09 - Updated: 2026-09-14 05:28

Summary

Red Hat Security Advisory: httpd security update

Severity

Important

Notes

Topic: An update for httpd is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-42516

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64	—	Vendor Fix fix Workaround

Known not affected 70 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2026-28780

A flaw was found in mod_proxy_ajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP (Apache JServ Protocol) server, to send a specially crafted message. This message can cause mod_proxy_ajp to write attacker-controlled data beyond a heap-based buffer, potentially leading to arbitrary code execution or a denial of service.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Important

CVE-2026-29167

A flaw was found in Apache HTTP Server when using the `mod_ldap` module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service (DoS) due to improper memory handling. This could lead to system instability or unauthorized control over the affected server.

4.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64	—	Vendor Fix fix Workaround

Known not affected 70 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround

Threats

Impact Low

CVE-2026-29169

A flaw was found in the mod_dav_lock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Low

CVE-2026-33007

A flaw was found in the mod_authn_socache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Moderate

CVE-2026-33857

A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Moderate

CVE-2026-34032

A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially leads to memory disclosure and a denial of service.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE-170 - Improper Null Termination

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Moderate

CVE-2026-34059

A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the ajp_parse_data function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially leads to memory disclosure and a denial of service.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE-126 - Buffer Over-read

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Moderate

CVE-2026-34355

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64	—	Vendor Fix fix Workaround

Known not affected 70 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-34356

A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie* directives. This could lead to a denial of service (DoS) condition, making the server unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Moderate

CVE-2026-42536

A flaw was found in Apache HTTP Server, specifically within the mod_xml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service, information disclosure, or possibly arbitrary code execution.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 5 products, the same list as for CVE-2026-34355

Known not affected 70 products, the same list as for CVE-2026-34355

Threats

Impact Important

CVE-2026-43951

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when `mod_headers` and `mod_mime` are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Moderate

CVE-2026-44185

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64	—	Vendor Fix fix Workaround

Known not affected 70 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x	—	Workaround
Unresolved product id: AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-44186

A flaw was found in the `mod_proxy_ftp` module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol (FTP) server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service (DoS) for the affected server.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Important

CVE-2026-44631

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service.

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

CWE-124 - Buffer Underwrite ('Buffer Underflow')

Affected products

Fixed 5 products, the same list as for CVE-2024-42516

Known not affected 70 products, the same list as for CVE-2024-42516

Threats

Impact Moderate

References

79 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:66323	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2374549	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464940	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464952	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464953	external
https://bugzilla.redhat.com/show_bug.cgi?id=2465296	external
https://bugzilla.redhat.com/show_bug.cgi?id=2465299	external
https://bugzilla.redhat.com/show_bug.cgi?id=2466913	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486394	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486395	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486397	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486399	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486402	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486411	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486414	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486415	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-42516	self
https://bugzilla.redhat.com/show_bug.cgi?id=2374549	external
https://www.cve.org/CVERecord?id=CVE-2024-42516	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42516	external
https://httpd.apache.org/security/vulnerabilities…	external
https://access.redhat.com/security/cve/CVE-2026-28780	self
https://bugzilla.redhat.com/show_bug.cgi?id=2466913	external
https://www.cve.org/CVERecord?id=CVE-2026-28780	external
https://nvd.nist.gov/vuln/detail/CVE-2026-28780	external
https://access.redhat.com/security/cve/CVE-2026-29167	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486394	external
https://www.cve.org/CVERecord?id=CVE-2026-29167	external
https://nvd.nist.gov/vuln/detail/CVE-2026-29167	external
https://access.redhat.com/security/cve/CVE-2026-29169	self
https://bugzilla.redhat.com/show_bug.cgi?id=2465296	external
https://www.cve.org/CVERecord?id=CVE-2026-29169	external
https://nvd.nist.gov/vuln/detail/CVE-2026-29169	external
https://access.redhat.com/security/cve/CVE-2026-33007	self
https://bugzilla.redhat.com/show_bug.cgi?id=2465299	external
https://www.cve.org/CVERecord?id=CVE-2026-33007	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33007	external
https://access.redhat.com/security/cve/CVE-2026-33857	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464953	external
https://www.cve.org/CVERecord?id=CVE-2026-33857	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33857	external
https://access.redhat.com/security/cve/CVE-2026-34032	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464952	external
https://www.cve.org/CVERecord?id=CVE-2026-34032	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34032	external
https://access.redhat.com/security/cve/CVE-2026-34059	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464940	external
https://www.cve.org/CVERecord?id=CVE-2026-34059	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34059	external
https://access.redhat.com/security/cve/CVE-2026-34355	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486414	external
https://www.cve.org/CVERecord?id=CVE-2026-34355	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34355	external
https://access.redhat.com/security/cve/CVE-2026-34356	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486395	external
https://www.cve.org/CVERecord?id=CVE-2026-34356	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34356	external
https://access.redhat.com/security/cve/CVE-2026-42536	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486411	external
https://www.cve.org/CVERecord?id=CVE-2026-42536	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42536	external
https://access.redhat.com/security/cve/CVE-2026-43951	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486415	external
https://www.cve.org/CVERecord?id=CVE-2026-43951	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43951	external
https://access.redhat.com/security/cve/CVE-2026-44185	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486397	external
https://www.cve.org/CVERecord?id=CVE-2026-44185	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44185	external
https://access.redhat.com/security/cve/CVE-2026-44186	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486402	external
https://www.cve.org/CVERecord?id=CVE-2026-44186	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44186	external
https://access.redhat.com/security/cve/CVE-2026-44631	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486399	external
https://www.cve.org/CVERecord?id=CVE-2026-44631	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44631	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for httpd is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.\n\nSecurity Fix(es):\n\n* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n\n* httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)\n\n* httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)\n\n* httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)\n\n* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n\n* httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)\n\n* Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)\n\n* httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n\n* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n\n* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n\n* httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)\n\n* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n\n* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n\n* httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66323",
        "url": "https://access.redhat.com/errata/RHSA-2026:66323"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2374549",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374549"
      },
      {
        "category": "external",
        "summary": "2464940",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464940"
      },
      {
        "category": "external",
        "summary": "2464952",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464952"
      },
      {
        "category": "external",
        "summary": "2464953",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464953"
      },
      {
        "category": "external",
        "summary": "2465296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465296"
      },
      {
        "category": "external",
        "summary": "2465299",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465299"
      },
      {
        "category": "external",
        "summary": "2466913",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
      },
      {
        "category": "external",
        "summary": "2486394",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486394"
      },
      {
        "category": "external",
        "summary": "2486395",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486395"
      },
      {
        "category": "external",
        "summary": "2486397",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486397"
      },
      {
        "category": "external",
        "summary": "2486399",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486399"
      },
      {
        "category": "external",
        "summary": "2486402",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486402"
      },
      {
        "category": "external",
        "summary": "2486411",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486411"
      },
      {
        "category": "external",
        "summary": "2486414",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486414"
      },
      {
        "category": "external",
        "summary": "2486415",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486415"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66323.json"
      }
    ],
    "title": "Red Hat Security Advisory: httpd security update",
    "tracking": {
      "current_release_date": "2026-09-14T05:28:55+00:00",
      "generator": {
        "date": "2026-09-14T05:28:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:66323",
      "initial_release_date": "2026-09-10T06:09:49+00:00",
      "revision_history": [
        {
          "date": "2026-09-10T06:09:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-10T06:09:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-14T05:28:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
                  "product_id": "AppStream-9.4.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.4::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.57-11.el9_4.5.src",
                "product": {
                  "name": "httpd-0:2.4.57-11.el9_4.5.src",
                  "product_id": "httpd-0:2.4.57-11.el9_4.5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.57-11.el9_4.5?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-core-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-core-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-devel@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_lua-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_lua-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html@2.4.57-11.el9_4.5?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_session-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_session-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl@2.4.57-11.el9_4.5?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debugsource@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.57-11.el9_4.5?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.57-11.el9_4.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
                "product": {
                  "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
                  "product_id": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.57-11.el9_4.5?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-devel@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html@2.4.57-11.el9_4.5?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_session-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_session-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl@2.4.57-11.el9_4.5?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debugsource@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
                "product": {
                  "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_id": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.57-11.el9_4.5?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-core-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-core-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-devel-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-devel-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-devel@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-tools-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-tools-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_ldap-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_ldap-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_lua-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_lua-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html@2.4.57-11.el9_4.5?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_session-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_session-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-1:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_ssl-1:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_ssl-1:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl@2.4.57-11.el9_4.5?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debugsource@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.57-11.el9_4.5?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.57-11.el9_4.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
                "product": {
                  "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
                  "product_id": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.57-11.el9_4.5?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-core-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-core-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-devel@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_lua-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_lua-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html@2.4.57-11.el9_4.5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_session-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_session-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl@2.4.57-11.el9_4.5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debugsource@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-core-debuginfo@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-debuginfo@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-tools-debuginfo@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ldap-debuginfo@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_lua-debuginfo@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_html-debuginfo@2.4.57-11.el9_4.5?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_session-debuginfo@2.4.57-11.el9_4.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
                "product": {
                  "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
                  "product_id": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_ssl-debuginfo@2.4.57-11.el9_4.5?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
                "product": {
                  "name": "httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
                  "product_id": "httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-filesystem@2.4.57-11.el9_4.5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-manual-0:2.4.57-11.el9_4.5.noarch",
                "product": {
                  "name": "httpd-manual-0:2.4.57-11.el9_4.5.noarch",
                  "product_id": "httpd-manual-0:2.4.57-11.el9_4.5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd-manual@2.4.57-11.el9_4.5?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.57-11.el9_4.5.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src"
        },
        "product_reference": "httpd-0:2.4.57-11.el9_4.5.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-core-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-core-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-core-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-devel-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-filesystem-0:2.4.57-11.el9_4.5.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch"
        },
        "product_reference": "httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-manual-0:2.4.57-11.el9_4.5.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch"
        },
        "product_reference": "httpd-manual-0:2.4.57-11.el9_4.5.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-tools-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_ldap-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_lua-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_lua-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_lua-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_session-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_session-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_session-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_session-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-1:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-1:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-1:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_ssl-1:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-1:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64"
        },
        "product_reference": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le"
        },
        "product_reference": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x"
        },
        "product_reference": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        },
        "product_reference": "mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-42516",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2025-06-24T12:01:28.570000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2374549"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a \"complete\" fix for CVE-2023-38709.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: incomplete fix for CVE-2023-38709",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable by a malicious backend or a malicious application, but may also affect forward proxy configurations.\n\nThis issue is classified as a Moderate vulnerability because successful exploitation requires a highly specific and constrained setup. Namely, the attacker must already have the ability to influence backend responses\u2014such as injecting malicious headers like Content-Type or Content-Encoding\u2014which typically implies a compromised or poorly controlled upstream service. In properly configured systems, frontend servers like Apache sanitize or strictly validate backend output, limiting exposure. Furthermore, HTTP response splitting does not inherently lead to remote code execution or privilege escalation on the server itself; instead, its effects are typically confined to manipulating client-side behavior such as caching or redirection.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-42516"
        },
        {
          "category": "external",
          "summary": "RHBZ#2374549",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374549"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-42516",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-42516"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-42516",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42516"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2025-07-14T07:13:28.880000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: incomplete fix for CVE-2023-38709"
    },
    {
      "cve": "CVE-2026-28780",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-05-05T22:01:12.666022+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466913"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in mod_proxy_ajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP (Apache JServ Protocol) server, to send a specially crafted message. This message can cause mod_proxy_ajp to write attacker-controlled data beyond a heap-based buffer, potentially leading to arbitrary code execution or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466913",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28780",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28780"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28780",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28780"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-05T21:29:41.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow"
    },
    {
      "cve": "CVE-2026-29167",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-06-08T16:01:30.220956+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server when using the `mod_ldap` module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service (DoS) due to improper memory handling. This could lead to system instability or unauthorized control over the affected server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "CISA\u0027s 9.8 is a mechanical worst-case UAF score. Their vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H \u2014 they\u0027re treating it as: \"network-facing service, memory corruption primitive, assume RCE.\" This is how CISA-ADP routinely scores any UAF in a network daemon. They don\u0027t analyze actual exploitability; they score the theoretical ceiling of the vulnerability class.\n\nApache\u0027s LOW reflects what actually happens. \n\n1. Trigger is narrow \u2014 mod_ldap must be loaded (not default) AND configured in per-directory context (\u003cDirectory\u003e, \u003cLocation\u003e, .htaccess). Server-wide LDAP config doesn\u0027t trigger it. This is an unusual configuration pattern.\n2. UAF in config merging, not request handling \u2014 the freed memory is in the per-directory configuration merge path, which constrains the timing window and what objects occupy the freed allocation. This isn\u0027t a heap spray-friendly UAF in a hot request path.\n3. httpd\u0027s process model kills RCE reliability \u2014 prefork uses separate processes (crash = one child dies, parent respawns), worker/event have per-process address space. Turning a UAF into reliable RCE against httpd is substantially harder than against a single-threaded daemon with a predictable heap layout.\n4. Realistic impact is DoS \u2014 the freed pointer will most likely cause a segfault (child crash), not a controlled write primitive. The parent process respawns workers, so even the DoS is transient.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29167"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29167",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29167"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29167",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29167"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:07:59.231000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "upgrade apache web server to 2.4.68",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration"
    },
    {
      "cve": "CVE-2026-29169",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-05-04T15:01:18.611919+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2465296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_dav_lock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: NULL pointer dereference via specially crafted request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue allows an unauthenticated remote attacker to crash the server via a specially crafted request. However, the mod_dav_lock module is obsolete and rarely enabled in modern environments. The only known use-case for the module was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Due to this reason, this vulnerability has been rated with a low severity.\n\nThis flaw only affects configurations with mod_dav_lock loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29169"
        },
        {
          "category": "external",
          "summary": "RHBZ#2465296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29169",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29169"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29169",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29169"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T14:48:29.832000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_dav_lock and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: NULL pointer dereference via specially crafted request"
    },
    {
      "cve": "CVE-2026-33007",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-05-04T15:01:24.989510+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2465299"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_authn_socache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue allows an unauthenticated remote attacker to cause a crash in a child process. However, the main parent process remains active and functional. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_authn_socache loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33007"
        },
        {
          "category": "external",
          "summary": "RHBZ#2465299",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465299"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33007",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33007"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33007"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T14:41:27.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_authn_socache and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash"
    },
    {
      "cve": "CVE-2026-33857",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-05-04T14:01:10.810459+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464953"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, the Apache HTTP Server must be configured to connect to an untrusted or compromised AJP backend server, limiting its exposure. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_proxy_ajp loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33857"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464953",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464953"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33857",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33857"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33857",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33857"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T13:07:30.753000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions"
    },
    {
      "cve": "CVE-2026-34032",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "discovery_date": "2026-05-04T14:01:07.000400+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially leads to memory disclosure and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, the Apache HTTP Server must be configured to connect to an untrusted or compromised AJP backend server, limiting its exposure. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_proxy_ajp loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34032"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34032",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34032"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34032",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34032"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T12:54:54.383000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check"
    },
    {
      "cve": "CVE-2026-34059",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2026-05-04T13:01:08.557596+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464940"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the ajp_parse_data function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially leads to memory disclosure and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, the Apache HTTP Server must be configured to connect to an untrusted or compromised AJP backend server, limiting its exposure. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_proxy_ajp loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34059"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464940",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464940"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34059"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T12:39:42.273000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()"
    },
    {
      "cve": "CVE-2026-34355",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:02:27.677660+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486414"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in `mod_proxy_html` within the Apache HTTP Server allows an untrusted backend to trigger a buffer overflow. This could lead to a security bypass or arbitrary code execution, posing a significant risk in environments where `httpd` is configured with untrusted backend services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486414",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486414"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34355"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:20:30.900000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Disable the `mod_proxy_html` module if it is not essential for your Apache HTTP Server configuration. If `mod_proxy_html` is required, restrict its use to trusted backend servers only, employing network segmentation and access controls. After modifying the configuration, reload the httpd service for changes to apply, which may cause a brief service interruption.\n\nSteps to disable:\nOpen /etc/httpd/conf.modules.d/00-proxy.conf.\nAdd a # to comment out the line: LoadModule proxy_html_module modules/mod_proxy_html.so\nVerify configuration syntax: apachectl configtest\nApply the change gracefully: systemctl reload httpd",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass"
    },
    {
      "cve": "CVE-2026-34356",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:01:32.651836+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486395"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie* directives. This could lead to a denial of service (DoS) condition, making the server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in Apache could allow a malicious backend server to crash your web server, making it unavailable to users. Your system is only at risk if you use Apache to forward traffic to untrusted or unverified backend systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34356"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486395",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486395"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34356",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34356"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34356",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34356"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:12:21.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "To prevent this denial-of-service flaw, ensure your Apache proxy rules only connect to highly trusted backend servers. If you must proxy traffic to unverified or external backends, disable the cookie-rewriting features.\n\nSteps to Mitigate:\n\nOpen your Apache configuration file (e.g., /etc/httpd/conf/httpd.conf).\nLocate and comment out any ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath lines pointing to untrusted backends by adding a # at the start of the line.\nTest your syntax: apachectl configtest\nApply changes gracefully: systemctl reload httpd\nNote: This may cause a brief service interruption.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers"
    },
    {
      "cve": "CVE-2026-42536",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:02:19.284204+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server, specifically within the mod_xml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service, information disclosure, or possibly arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat Enterprise Linux (RHEL), the httpd package includes mod_xml2enc, which provides encoding support for filters like mod_proxy_html. Because this flaw relies on processing unvetted or untrusted input text lengths, the impact presents a high risk to availability (Denial of Service via worker crashes) and a potential risk to confidentiality if an attacker is capable of executing remote code within the context of the apache or httpd daemon process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42536"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42536",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42536"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42536",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42536"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:23:46.290000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, disable the `mod_xml2enc` module if its functionality for XML internationalization is not essential. This can be done by commenting out the `LoadModule xml2enc_module modules/mod_xml2enc.so` directive in the Apache HTTP Server configuration. A service restart is required for the change to take effect.\n\n```bash\n# Edit the Apache configuration file, e.g., /etc/httpd/conf.modules.d/00-base.conf\n# Comment out the line:\n# LoadModule xml2enc_module modules/mod_xml2enc.so\n\n# Reload the httpd service\nsudo systemctl reload httpd\n```\n\n*Note: Disabling `mod_xml2enc` will cause any configurations relying heavily on `mod_proxy_html` or raw HTML/XML encoding conversions to function incorrectly or fail. Red Hat strongly recommends upgrading to a patched version of `httpd` as soon as it becomes available for your specific RHEL channel.*",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc"
    },
    {
      "cve": "CVE-2026-43951",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-08T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486415"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when `mod_headers` and `mod_mime` are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Apache HTTP Server arises from an out-of-bounds read when both `mod_headers` and `mod_mime` modules are active and configured for multiple response languages. While this configuration is not universally enabled by default in Red Hat products, affected systems could be vulnerable to information disclosure or denial of service if these specific modules and language settings are in use. Exploitation requires a remote attacker to trigger this specific module interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43951"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486415",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486415"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43951",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43951"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43951",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43951"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:16:14.594000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "- Those who do not require multi-language response headers can remove or disable the `mod_headers` and `mod_mime` modules, or remove Content-Language directives from their configuration. \n- Systems not using these modules in combination are not affected.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime"
    },
    {
      "cve": "CVE-2026-44185",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-08T16:01:37.898883+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486397"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A critical buffer over-read flaw in Apache HTTP Server occurs when it performs outbound OCSP requests. If a server connects to an attacker-controlled OCSP responder, a remote attacker can leak sensitive memory data or trigger a denial of service (DoS). This risk depends entirely on the server\u0027s OCSP configuration and endpoint trustworthiness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44185"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486397",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486397"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44185",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44185"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44185",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44185"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:22:11.809000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that Apache HTTP Server is configured to only communicate with trusted OCSP responders. If OCSP validation or stapling is not a critical requirement for your deployment, consider disabling it. This can be achieved by adjusting mod_ssl directives in your Apache HTTP Server configuration. \n\nFor example, add or modify the following lines:\n\n~~~\nSSLOCSPEnable off\nSSLUseStapling off\n~~~\n\nAfter modifying the configuration, reload the httpd service for the changes to take effect safely without interrupting active connections:\n\n~~~\nsudo systemctl reload httpd\n~~~",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server"
    },
    {
      "cve": "CVE-2026-44186",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-06-08T16:01:53.173507+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486402"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `mod_proxy_ftp` module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol (FTP) server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service (DoS) for the affected server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A loop with an unreachable exit condition flaw was found in the mod_proxy_ftp module of the Apache HTTP Server. A remote attacker could exploit this vulnerability by tricking the server into connecting to a malicious or compromised backend FTP server, causing the proxy_ftp_handler component to enter an infinite loop. This results in CPU exhaustion and a denial of service (DoS) condition on the affected system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486402",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486402"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44186"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:11:12.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, you can disable the `mod_proxy_ftp` module if your environment does not require it.\n\n#### **Step 1: Disable the Module**\n\nOpen your Apache HTTP Server configuration file (commonly located at `/etc/httpd/conf.modules.d/00-proxy.conf` or `/etc/httpd/conf/httpd.conf`) and comment out or remove the following line:\n\n```\n# LoadModule proxy_ftp_module modules/mod_proxy_ftp.so\n```\n#### **Step 2: Restart the Service**\n\nRestart the `httpd` service to apply the configuration changes:\n```\nsystemctl restart httpd\n```\n**Note:** Disabling this module may impact applications or services that rely on Apache\u0027s FTP proxy functionality.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server"
    },
    {
      "cve": "CVE-2026-44631",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:01:43.891910+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486399"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server\u0027s configuration. An attacker could potentially exploit this to cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Denial of Service via crafted regular expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact buffer underwrite flaw in Apache HTTP Server can lead to a denial of service. The vulnerability occurs when processing specially crafted regular expressions within the server\u0027s configuration. Exploitation requires a high attack complexity, indicating that specific conditions or a complex attack vector are necessary, thereby limiting the practical risk in typical Red Hat deployments where configuration changes are tightly controlled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
          "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486399",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486399"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44631"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:19:23.570000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T06:09:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66323"
        },
        {
          "category": "workaround",
          "details": "Only loadtrustedApache configuration; the bug triggers oncrafted regexin config at start/reload (DirectoryMatch,Directory ~,ProxyMatch, etc.).\nKeep AllowOverride None where possible so untrusted users cannot inject regex via .htaccess.\nRestrict who can change httpdconfig and reload the service.",
          "product_ids": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.src",
            "AppStream-9.4.0.Z.E4S:httpd-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-core-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-debugsource-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-devel-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-filesystem-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-manual-0:2.4.57-11.el9_4.5.noarch",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:httpd-tools-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ldap-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_lua-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_proxy_html-debuginfo-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_session-debuginfo-0:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-1:2.4.57-11.el9_4.5.x86_64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.aarch64",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.ppc64le",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.s390x",
            "AppStream-9.4.0.Z.E4S:mod_ssl-debuginfo-1:2.4.57-11.el9_4.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Denial of Service via crafted regular expressions"
    }
  ]
}

CVE-2026-42536 (GCVE-0-2026-42536)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:23 – Updated: 2026-09-10 12:05

Title

Apache HTTP Server: mod_xml2enc heap overflow

Summary

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 18:09 UTC

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

apache mitre root

References

15 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/06/08/9
https://access.redhat.com/security/cve/CVE-2026-42536	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486411	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:56868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47046	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34109	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42828	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66323	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62165	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41906	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25042	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53371	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56869	vendor-advisoryx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.67 (semver)
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:2.4.62-16.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:2.0.29-13.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:1.2.50-17.redhat_1.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 1:2.4.28-19.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:1.3.22-12.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:2.9.6-19.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:2.4.63-13.el10_2.4 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:2.4.63-1.el10_0.4 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260714175253.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.4.62-13.el9_8.5 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:2.4.57-11.el9_4.5 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.4.62-4.el9_6.6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat JBoss Core Services 2.4.62.SP5	Unaffected: httpd24-httpd , < * (rpm) cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat Hardened Images	Unaffected: 2.4.68-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1786433656 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Credits

Zhenpeng (Leo) Lin at depthfirst

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42536",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T18:09:39.478431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T18:10:10.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-08T22:32:27.355Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/08/9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-httpd",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.62-16.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_http2",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.0.29-13.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_jk",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.2.50-17.redhat_1.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_md",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.4.28-19.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_proxy_cluster",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.3.22-12.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_security",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.9.6-19.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.63-13.el10_2.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.63-1.el10_0.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd:2.4",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260714175253.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.62-13.el9_8.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.57-11.el9_4.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.62-4.el9_6.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs",
            "product": "Red Hat JBoss Core Services 2.4.62.SP5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "httpd24-httpd",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2.4.68-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:insights_proxy:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "insights-proxy/insights-proxy-container-rhel9",
            "product": "Red Hat Insights proxy 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786433656",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-08T15:23:46.290Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Apache HTTP Server, specifically within the mod_xml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service, information disclosure, or possibly arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T12:05:09.471Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42536"
          },
          {
            "name": "RHBZ#2486411",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486411"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42536.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47046"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34109"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42828"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66323"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62165"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41906"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25042"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53371"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56869"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:56868: Red Hat JBoss Core Services on RHEL 8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47046: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34109: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42828: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66323: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62165: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41906: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25042: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53371: Red Hat Insights proxy 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56869: Red Hat JBoss Core Services 2.4.62.SP5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-08T16:02:19.284Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-08T15:23:46.290Z",
            "value": "Made public."
          }
        ],
        "title": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, disable the `mod_xml2enc` module if its functionality for XML internationalization is not essential. This can be done by commenting out the `LoadModule xml2enc_module modules/mod_xml2enc.so` directive in the Apache HTTP Server configuration. A service restart is required for the change to take effect.\n\n```bash\n# Edit the Apache configuration file, e.g., /etc/httpd/conf.modules.d/00-base.conf\n# Comment out the line:\n# LoadModule xml2enc_module modules/mod_xml2enc.so\n\n# Reload the httpd service\nsudo systemctl reload httpd\n```\n\n*Note: Disabling `mod_xml2enc` will cause any configurations relying heavily on `mod_proxy_html` or raw HTML/XML encoding conversions to function incorrectly or fail. Red Hat strongly recommends upgrading to a patched version of `httpd` as soon as it becomes available for your specific RHEL channel.*"
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.67",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhenpeng (Leo) Lin at depthfirst"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHeap-based Buffer Overflow vulnerability in Apache HTTP Server with\u0026nbsp;mod_xml2enc, xml2StartParse, and untrusted content\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.68, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Heap-based Buffer Overflow vulnerability in Apache HTTP Server with\u00a0mod_xml2enc, xml2StartParse, and untrusted content\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T15:23:46.290Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-27T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-06-04T12:00:00.000Z",
          "value": "fixed in 2.4.x by r1934971"
        },
        {
          "lang": "eng",
          "time": "2026-06-08T12:00:00.000Z",
          "value": "2.4.68 released"
        }
      ],
      "title": "Apache HTTP Server: mod_xml2enc heap overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-42536",
    "datePublished": "2026-06-08T15:23:46.290Z",
    "dateReserved": "2026-04-28T16:06:25.760Z",
    "dateUpdated": "2026-09-10T12:05:09.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43951 (GCVE-0-2026-43951)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:16 – Updated: 2026-06-08 22:32

Title

Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

Summary

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 18:13 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

apache mitre root

References

2 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.67 (semver)

Credits

Zhenpeng (Leo) Lin at depthfirst

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-43951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T18:13:37.250801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T18:14:03.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-08T22:32:28.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/08/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.67",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhenpeng (Leo) Lin at depthfirst"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOut-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67."
            }
          ],
          "value": "Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T15:16:14.594Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-27T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-06-05T12:00:00.000Z",
          "value": "fixed in 2.4.x by r1935006"
        },
        {
          "lang": "eng",
          "time": "2026-06-08T12:00:00.000Z",
          "value": "2.4.68 released"
        }
      ],
      "title": "Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-43951",
    "datePublished": "2026-06-08T15:16:14.594Z",
    "dateReserved": "2026-05-04T17:15:44.253Z",
    "dateUpdated": "2026-06-08T22:32:28.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44185 (GCVE-0-2026-44185)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:22 – Updated: 2026-09-11 12:09

Title

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

Summary

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 18:10 UTC

CWE

CWE-126 - Buffer Over-read
CWE-125 - Out-of-bounds Read

Assigner

apache mitre root

References

15 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…
https://access.redhat.com/security/cve/CVE-2026-44185	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486397	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:56868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47046	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34109	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42828	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66323	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62165	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41906	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25042	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53371	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56869	vendor-advisoryx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.67 (semver)
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:2.4.62-16.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:2.0.29-13.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:1.2.50-17.redhat_1.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 1:2.4.28-19.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:1.3.22-12.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:2.9.6-19.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:2.4.63-13.el10_2.4 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:2.4.63-1.el10_0.4 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260714175253.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.4.62-13.el9_8.5 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:2.4.57-11.el9_4.5 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.4.62-4.el9_6.6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat JBoss Core Services 2.4.62.SP5	Unaffected: httpd24-httpd , < * (rpm) cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat Hardened Images	Unaffected: 2.4.68-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1786433656 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Credits

Zhenpeng (Leo) Lin at depthfirst

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-44185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T18:10:50.653826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T18:11:21.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-08T22:32:30.948Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/08/12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-httpd",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.62-16.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_http2",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.0.29-13.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_jk",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.2.50-17.redhat_1.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_md",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.4.28-19.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_proxy_cluster",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.3.22-12.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-mod_security",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.9.6-19.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.63-13.el10_2.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.63-1.el10_0.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd:2.4",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260714175253.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.62-13.el9_8.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.57-11.el9_4.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.62-4.el9_6.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs",
            "product": "Red Hat JBoss Core Services 2.4.62.SP5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "httpd24-httpd",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2.4.68-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:insights_proxy:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "insights-proxy/insights-proxy-container-rhel9",
            "product": "Red Hat Insights proxy 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786433656",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "httpd",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-08T15:22:11.809Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T12:09:02.318Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-44185"
          },
          {
            "name": "RHBZ#2486397",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486397"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44185.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47046"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34109"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42828"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66323"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62165"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41906"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25042"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53371"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56869"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:56868: Red Hat JBoss Core Services on RHEL 8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47046: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34109: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42828: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66323: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62165: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41906: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25042: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53371: Red Hat Insights proxy 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56869: Red Hat JBoss Core Services 2.4.62.SP5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-08T16:01:37.898Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-08T15:22:11.809Z",
            "value": "Made public."
          }
        ],
        "title": "httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, ensure that Apache HTTP Server is configured to only communicate with trusted OCSP responders. If OCSP validation or stapling is not a critical requirement for your deployment, consider disabling it. This can be achieved by adjusting mod_ssl directives in your Apache HTTP Server configuration. \n\nFor example, add or modify the following lines:\n\n~~~\nSSLOCSPEnable off\nSSLUseStapling off\n~~~\n\nAfter modifying the configuration, reload the httpd service for the changes to take effect safely without interrupting active connections:\n\n~~~\nsudo systemctl reload httpd\n~~~"
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.67",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhenpeng (Leo) Lin at depthfirst"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBuffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.68, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "CWE-126 Buffer Over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T15:22:11.809Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-27T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-06-03T12:00:00.000Z",
          "value": "fixed in 2.4.x by r1934919"
        },
        {
          "lang": "eng",
          "time": "2026-06-08T12:00:00.000Z",
          "value": "2.4.68 released"
        }
      ],
      "title": "Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-44185",
    "datePublished": "2026-06-08T15:22:11.809Z",
    "dateReserved": "2026-05-05T14:42:10.681Z",
    "dateUpdated": "2026-09-11T12:09:02.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44186 (GCVE-0-2026-44186)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:11 – Updated: 2026-06-09 12:20

Title

Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

Summary

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 12:20 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

apache mitre root

References

2 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.67 (semver)

Credits

Zhenpeng (Leo) Lin at depthfirst

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-08T22:32:32.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/08/13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-44186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T12:20:03.384693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T12:20:10.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.67",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhenpeng (Leo) Lin at depthfirst"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eLoop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.\u003c/p\u003e\u003cp\u003eThis issue affects undefined: from 2.4.0 through 2.4.67.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.68, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.\n\nThis issue affects undefined: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T15:11:12.743Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-27T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-06-05T12:00:00.000Z",
          "value": "fixed in 2.4.x by r1935004"
        },
        {
          "lang": "eng",
          "time": "2026-06-08T12:00:00.000Z",
          "value": "2.4.68 released"
        }
      ],
      "title": "Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-44186",
    "datePublished": "2026-06-08T15:11:12.743Z",
    "dateReserved": "2026-05-05T15:00:32.613Z",
    "dateUpdated": "2026-06-09T12:20:10.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44631 (GCVE-0-2026-44631)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:19 – Updated: 2026-06-08 22:32

Title

Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

Summary

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 19:43 UTC

CWE

CWE-124 - Buffer Underwrite

Assigner

apache mitre root

References

2 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.67 (semver)

Credits

Zhenpeng (Leo) Lin at depthfirst Bartlomiej Dmitruk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-44631",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T19:43:09.481041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T19:43:13.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-08T22:32:33.325Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/08/14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.67",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhenpeng (Leo) Lin at depthfirst"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Bartlomiej Dmitruk"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBuffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.68, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.\n\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-124",
              "description": "CWE-124: Buffer Underwrite",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T15:19:23.570Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-27T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-06-05T12:00:00.000Z",
          "value": "fixed in 2.4.x by r1935015"
        },
        {
          "lang": "eng",
          "time": "2026-06-08T12:00:00.000Z",
          "value": "2.4.68 released"
        }
      ],
      "title": "Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-44631",
    "datePublished": "2026-06-08T15:19:23.570Z",
    "dateReserved": "2026-05-07T12:39:02.065Z",
    "dateUpdated": "2026-06-08T22:32:33.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:66323

CVE-2026-42536 (GCVE-0-2026-42536)

CVE-2026-43951 (GCVE-0-2026-43951)

CVE-2026-44185 (GCVE-0-2026-44185)

CVE-2026-44186 (GCVE-0-2026-44186)

CVE-2026-44631 (GCVE-0-2026-44631)

Tags

Sightings

Nomenclature