Loading story…
Red Hat published Important security updates for Apache HTTP Server packages across Red Hat Enterprise Linux 8, 9, and 10 and related JBoss Core Services offerings, addressing multiple upstream httpd vulnerabilities. The updates remediate CVE-2025-65082, which can let Apache configuration-set variables unexpectedly override server-calculated CGI environment variables, and CVE-2025-66200, a mod_userdir + suexec bypass in which an attacker able to use the RequestHeader directive in an .htaccess file may cause some CGI scripts to run under an unexpected user ID. Red Hat advisories for RHEL 9 and 10 also include fixes for CVE-2025-58098, where Server Side Includes appends the query string to #exec cmd, while the RHEL 8 httpd:2.4 module update additionally addresses CVE-2025-55753.
The affected Apache HTTP Server ranges extend through 2.4.65, and upstream guidance points users to 2.4.66 for remediation. Red Hat shipped patched builds including httpd-2.4.62-7.el9_7.3 for RHEL 9 and httpd-2.4.63-4.el10_1.3 for RHEL 10, with corresponding package updates across major architectures and lifecycle channels; the RHEL 8 advisory likewise delivers updated httpd, mod_ssl, mod_http2, mod_md, and related components. The fixes were released under advisories RHSA-2025:23732, RHSA-2025:23919, and RHSA-2025:23932.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2025-12-22, Red Hat published RHSA-2025:23932, an Important security advisory for RHEL 10 httpd packages. The update fixes CVE-2025-65082 and CVE-2025-66200, as well as CVE-2025-58098.
On 2025-12-22, Red Hat published RHSA-2025:23919, an Important security advisory for RHEL 9 httpd packages. The advisory fixes Apache HTTP Server vulnerabilities including CVE-2025-65082 and CVE-2025-66200.
On 2025-12-22, Red Hat published RHSA-2025:23732, an Important security advisory for the RHEL 8 httpd:2.4 module. The update fixes CVE-2025-65082 and CVE-2025-66200, along with CVE-2025-55753 and CVE-2025-58098.
Red Hat tracked CVE-2025-65082 as Bugzilla 2419139, covering an Apache HTTP Server CGI environment variable override flaw affecting versions 2.4.0 through 2.4.65. The bug record states version 2.4.66 fixes the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `httpd:2.4` across multiple Red Hat Enterprise Linux 8 support channels to remediate two Apache HTTP Server vulnerabilities, **CVE-2025-55753** and **CVE-2025-58098**. The first flaw affects `mod_md` ACME certificate renewal handling in Apache HTTP Server versions `2.4.30` through `2.4.65`, where an integer overflow can drive the renewal backoff timer to zero after repeated failures and trigger continuous retry attempts until renewal succeeds. The second flaw affects Apache HTTP Server before `2.4.66` when **Server Side Includes** is enabled with `mod_cgid`, causing the shell-escaped query string to be passed to SSI `#exec cmd="..."` directives. The fixes were shipped through advisories including **RHSA-2026:0009**, **RHSA-2026:0010**, **RHSA-2026:0011**, and **RHSA-2026:0012**, covering RHEL 8.2, 8.4, 8.6, and 8.8 service variants such as AUS, EUS, SAP, Telecommunications, and Advanced Mission Critical Update Support. Updated packages include `httpd`, `mod_md`, `mod_http2`, `mod_ssl`, `mod_ldap`, `mod_proxy_html`, and `mod_session` for supported architectures, while Apache identified version `2.4.66` as the upstream fix level for both issues.
Aug 21, 2026
Red Hat released Important-rated security updates for `urllib3` across Red Hat Enterprise Linux 8, 9, and 10 to remediate `CVE-2026-44432` and `CVE-2026-44431`. The more severe issue, `CVE-2026-44432`, is a denial-of-service flaw in the Python HTTP client library that can let a remote attacker force excessive CPU and memory consumption when `urllib3` fully decompresses an HTTP response even though only a partial read was requested, or when it drains a connection after partial decompression. Red Hat assigned the bug a CVSS v3 score of 7.5 and mapped it to `CWE-409`. The advisories cover multiple package streams and architectures, including `python-urllib3` for RHEL 10, `python3.14-urllib3` for RHEL 9 and 10, and `python3.12-urllib3` for RHEL 8 and 9, with fixes delivered in versions such as `1.26.19-4.el10_2`, `2.6.3-2.el10_2`, `2.6.3-2.el9_8`, `1.26.19-3.el9_8`, and `1.26.19-3.el8_10`. Red Hat said the same updates also address `CVE-2026-44431`, an information disclosure flaw in which sensitive headers may be forwarded across origins during redirects, and listed affected offerings including Extended Update Support, Extended Life Cycle releases, and Red Hat Ansible Automation Platform 2.5 and 2.6 as fixed.
Aug 20, 2026
Red Hat released **Important** security updates for OpenSSL across multiple **RHEL 9** and **RHEL 10** channels to address two high-impact vulnerabilities, **`CVE-2025-15467`** and **`CVE-2025-69419`**. The first flaw affects parsing of CMS `AuthEnvelopedData` with AEAD ciphers, where an oversized initialization vector can overflow a fixed-size stack buffer before authentication or tag verification, creating a path to denial of service and possible remote code execution. The second flaw is a memory corruption bug in PKCS#12 processing, where `BMPString` to UTF-8 conversion can trigger an out-of-bounds heap write when an application parses an attacker-controlled PKCS#12 file, potentially causing a crash or arbitrary code execution. Upstream fixes were issued in OpenSSL **3.0.19**, **3.3.6**, **3.4.4**, **3.5.5**, **3.6.1**, and **1.1.1ze** for the affected branches, while OpenSSL **1.0.2** is not affected and the OpenSSL FIPS modules are outside the vulnerable code paths. Red Hat advisories including **RHSA-2026:1496**, **RHSA-2026:1503**, **RHSA-2026:1519**, **RHSA-2026:1594**, and **RHSA-2026:1733** cover impacted products such as RHEL 9.0, 9.2, 9.4, 9.6, and 10.0 variants, along with related SAP, AUS, EUS, OpenShift, and JBoss Core Services offerings, with updated package builds released for major architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`.
Aug 20, 2026