This Red Hat security advisory addresses multiple vulnerabilities in the Apache HTTP Server (`httpd:2.4` module), including critical flaws such as an HTTP/2 denial-of-service via memory exhaustion (CVE-2025-53020, CVSS 7.5 HIGH) and a heap-based buffer overflow in `mod_proxy_ajp` allowing arbitrary code execution (CVE-2026-28780). Affected versions include Apache HTTP Server 2.4.17 through 2.4.63 (for CVE-2025-53020) and versions prior to 2.4.67 (for several other CVEs). The fix requires applying the Red Hat update for the `httpd:2.4` module, which incorporates Apache versions 2.4.64 and 2.4.67.
Red Hat Product Errata RHSA-2026:36846 - Security Advisory Issued: 2026-07-08 Updated: 2026-07-08 RHSA-2026:36846 - Security Advisory Overview Updated Packages Synopsis Important: httpd:2.4 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64 Red Hat Enterprise Linux Server - AUS 8.4 x86_64 Fixes BZ - 2379343 - CVE-2025-53020 mod_http2: Apache HTTP Server: HTTP/2 DoS by Memory Increase BZ - 2464940 - CVE-2026-34059 httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() BZ - 2464952 - CVE-2026-34032 httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check BZ - 2464953 - CVE-2026-33857 httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions BZ - 2465299 - CVE-2026-33007 httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash BZ - 2466913 - CVE-2026-28780 Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow BZ - 2485371 - CVE-2026-49975 httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVEs CVE-2025-53020 CVE-2026-28780 CVE-2026-33007 CVE-2026-33857 CVE-2026-34032 CVE-2026-34059 CVE-2026-49975 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 SRPM httpd-2.4.37-39.module+el8.4.0+24495+1afced82.12.src.rpm SHA-256: 4c5f072d422e42b6e5f22bf2f0e9db82ff7f02c8a32bde5492bfc7943de60d9e mod_http2-1.15.7-3.module+el8.4.0+24495+1afced82.5.src.rpm SHA-256: 2e254d57d24081eef6c953161d3d817f91a6c75ec8fdecc298de359b7c07f887 mod_md-2.0.8-8.module+el8.4.0+23842+00253415.1.src.rpm SHA-256: 2203bc352db1f07d4ffa3d7977cea6eb9b38c62f49bb772078d7eb78c1289086 x86_64 httpd-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 02791400801ab2dcc280e304b9aab2768a0544e8c49779d23a4b6a169eeb36fa httpd-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: c08efea7fe67651e8111e7c499de409464e45160e24d64678183eb58854567b1 httpd-debugsource-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 7455b929458fb17b9a6e322cbe45c4fb958ddc3f5f850220b4d667e99e816d38 httpd-devel-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 99b5fb41cc4f10a2ca394cb0914ce0189c6d42ccb33e32285afae802c7ba1db9 httpd-filesystem-2.4.37-39.module+el8.4.0+24495+1afced82.12.noarch.rpm SHA-256: b4ca23208a34f75340ecefaef2e50abb6b53fbdfb6d93af5e840fb58f3667349 httpd-manual-2.4.37-39.module+el8.4.0+24495+1afced82.12.noarch.rpm SHA-256: 308046e18467eedb3878e443fcd86df4407b8b168c07694d0474dddf26113ce4 httpd-tools-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 945c82bd47b18e4e935a6d3be56e749dbc63c2d1848868ae856a13ab0803b374 httpd-tools-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 16e5c2021fc92b99f58b01ac70947d31c10c965c83981462c65985c765fcc8ca mod_http2-1.15.7-3.module+el8.4.0+24495+1afced82.5.x86_64.rpm SHA-256: 69af2d53a43bf93d33b4bfc9c754e41de064f5cb79793cec5eec8ac7ee5b56b4 mod_http2-debuginfo-1.15.7-3.module+el8.4.0+24495+1afced82.5.x86_64.rpm SHA-256: 7b89533bc9fa43e898bd2b4895eab2fe219993c25d5d5f536f81f8a81776ec11 mod_http2-debugsource-1.15.7-3.module+el8.4.0+24495+1afced82.5.x86_64.rpm SHA-256: 55acb11dda61b1c575fe8172b5321c75ddc159e3fb501f09c8fc4fe5c71000c7 mod_ldap-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: b3178a4218df0fd872fd6caa26eccb7514fd2d36397ad9dfd63dbe539a8cbb48 mod_ldap-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 04c9e2dd985ce01afdca016d7e6cbab9621e2bb9568dde86c46383629cec3c24 mod_md-2.0.8-8.module+el8.4.0+23842+00253415.1.x86_64.rpm SHA-256: 06e8b181fb7845a7bde85d583db1e42895d960361cb18cf4cda7925e5598ad36 mod_md-debuginfo-2.0.8-8.module+el8.4.0+23842+00253415.1.x86_64.rpm SHA-256: b172fb5e9efed740c6d365d9c706dcaaad26891815df02263b4534401a3b6c02 mod_md-debugsource-2.0.8-8.module+el8.4.0+23842+00253415.1.x86_64.rpm SHA-256: a2c430ec1967d4c76b5d21281337a15500d4e6b2e8dd03677f35fb01bce22b6c mod_proxy_html-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 4b9aed03ba3ce5cbd6f4bfd45f6ae12ff1f51893c35f4f5f64798f9cc7263d7e mod_proxy_html-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 2a48726f69209242c533cd2ca17888c7e5bb7dec59cd899679b166f0ced06765 mod_session-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: ea9e0a16f21dbc0afbb270b0ba1ed5b2d3e04e949f161ad39e1c952c439e6160 mod_session-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 02ba1f88d6f88e7a1d3d064e79f593435ca7f318ef69ba9d6ec484f6f970fdad mod_ssl-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 5de51adc55fa443f95724ed6bc856ee85bf5fa2cdd8f52b1c4d7dcd5b0de11cb mod_ssl-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 6910c58dfa7cb2426b6ab2064171be3d2c7b78d8d1132c8903b38637c7781fab Red Hat Enterprise Linux Server - AUS 8.4 SRPM httpd-2.4.37-39.module+el8.4.0+24495+1afced82.12.src.rpm SHA-256: 4c5f072d422e42b6e5f22bf2f0e9db82ff7f02c8a32bde5492bfc7943de60d9e mod_http2-1.15.7-3.module+el8.4.0+24495+1afced82.5.src.rpm SHA-256: 2e254d57d24081eef6c953161d3d817f91a6c75ec8fdecc298de359b7c07f887 mod_md-2.0.8-8.module+el8.4.0+23842+00253415.1.src.rpm SHA-256: 2203bc352db1f07d4ffa3d7977cea6eb9b38c62f49bb772078d7eb78c1289086 x86_64 httpd-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 02791400801ab2dcc280e304b9aab2768a0544e8c49779d23a4b6a169eeb36fa httpd-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: c08efea7fe67651e8111e7c499de409464e45160e24d64678183eb58854567b1 httpd-debugsource-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 7455b929458fb17b9a6e322cbe45c4fb958ddc3f5f850220b4d667e99e816d38 httpd-devel-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 99b5fb41cc4f10a2ca394cb0914ce0189c6d42ccb33e32285afae802c7ba1db9 httpd-filesystem-2.4.37-39.module+el8.4.0+24495+1afced82.12.noarch.rpm SHA-256: b4ca23208a34f75340ecefaef2e50abb6b53fbdfb6d93af5e840fb58f3667349 httpd-manual-2.4.37-39.module+el8.4.0+24495+1afced82.12.noarch.rpm SHA-256: 308046e18467eedb3878e443fcd86df4407b8b168c07694d0474dddf26113ce4 httpd-tools-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 945c82bd47b18e4e935a6d3be56e749dbc63c2d1848868ae856a13ab0803b374 httpd-tools-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 16e5c2021fc92b99f58b01ac70947d31c10c965c83981462c65985c765fcc8ca mod_http2-1.15.7-3.module+el8.4.0+24495+1afced82.5.x86_64.rpm SHA-256: 69af2d53a43bf93d33b4bfc9c754e41de064f5cb79793cec5eec8ac7ee5b56b4 mod_http2-debuginfo-1.15.7-3.module+el8.4.0+24495+1afced82.5.x86_64.rpm SHA-256: 7b89533bc9fa43e898bd2b4895eab2fe219993c25d5d5f536f81f8a81776ec11 mod_http2-debugsource-1.15.7-3.module+el8.4.0+24495+1afced82.5.x86_64.rpm SHA-256: 55acb11dda61b1c575fe8172b5321c75ddc159e3fb501f09c8fc4fe5c71000c7 mod_ldap-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: b3178a4218df0fd872fd6caa26eccb7514fd2d36397ad9dfd63dbe539a8cbb48 mod_ldap-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 04c9e2dd985ce01afdca016d7e6cbab9621e2bb9568dde86c46383629cec3c24 mod_md-2.0.8-8.module+el8.4.0+23842+00253415.1.x86_64.rpm SHA-256: 06e8b181fb7845a7bde85d583db1e42895d960361cb18cf4cda7925e5598ad36 mod_md-debuginfo-2.0.8-8.module+el8.4.0+23842+00253415.1.x86_64.rpm SHA-256: b172fb5e9efed740c6d365d9c706dcaaad26891815df02263b4534401a3b6c02 mod_md-debugsource-2.0.8-8.module+el8.4.0+23842+00253415.1.x86_64.rpm SHA-256: a2c430ec1967d4c76b5d21281337a15500d4e6b2e8dd03677f35fb01bce22b6c mod_proxy_html-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 4b9aed03ba3ce5cbd6f4bfd45f6ae12ff1f51893c35f4f5f64798f9cc7263d7e mod_proxy_html-debuginfo-2.4.37-39.module+el8.4.0+24495+1afced82.12.x86_64.rpm SHA-256: 2a48726f69209242c533cd2ca17888c7e5bb7dec59cd899679b166f0ced06765 mod_session-2.4.37-39.module+el8.4.0+24495+1afced82.12.