Loading story…
Red Hat released multiple security advisories for mod_md to address CVE-2026-29168, a Moderate-severity flaw in Apache HTTP Server's managed domain module that can allow resource exhaustion through unrestricted OCSP responses. The updates cover several RHEL 9 streams, including 9.2, 9.4, and 9.6 variants for standard, SAP, and extended lifecycle channels across x86_64, aarch64, ppc64le, and s390x, with fixed package versions including mod_md-2.4.19-1.el9_2.2, mod_md-2.4.19-1.el9_4.2, and mod_md-2.4.26-1.el9_6.2.
Red Hat also rolled the fix into Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4, which replaces Service Pack 3 and bundles broader security remediation for Apache HTTP Server components and dependencies. Those updates address additional issues in mod_proxy_ajp, mod_http2, mod_authn_socache, mod_dav_lock, and the bundled nghttp2 library, including a separate nghttp2 denial-of-service flaw, CVE-2026-27135, caused by malformed HTTP/2 frames after session termination that could trigger an assertion failure before version 1.68.1.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:57641 for RHEL 9.6 support channels, releasing mod_md 2.4.26-1.el9_6.2 to fix CVE-2026-29168. The advisory applies to Extended Update Support and related SAP Solutions and Extended Life Cycle channels across multiple architectures.
Red Hat issued RHSA-2026:57844 for multiple RHEL 9.4 variants, releasing mod_md-2.4.19-1.el9_4.2 to address CVE-2026-29168. The advisory covers SAP Solutions, Extended Life Cycle, and 4-years-of-updates offerings across x86_64, aarch64, ppc64le, and s390x.
Red Hat issued RHSA-2026:57642 for RHEL 9.2 channels, providing mod_md 2.4.19-1.el9_2.2 to fix CVE-2026-29168. Red Hat describes the flaw as an unrestricted OCSP response issue in httpd mod_md that can cause resource exhaustion.
Red Hat published RHSA-2026:27200 and RHSA-2026:27201 for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4, replacing Service Pack 3 and fixing multiple vulnerabilities. The updates include fixes for CVE-2026-27135 in nghttp2 and CVE-2026-29168 in mod_md, along with several Apache HTTP Server, OpenSSL, and Expat issues.
Red Hat documented CVE-2026-27135 as a denial-of-service flaw in nghttp2 versions prior to 1.68.1, caused by missing internal state validation after session termination that can lead to an assertion failure when malformed HTTP/2 frames are processed. The bug record states nghttp2 1.68.1 fixes the issue and that no workaround is known.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `httpd:2.4` across multiple Red Hat Enterprise Linux 8 support channels to remediate two Apache HTTP Server vulnerabilities, **CVE-2025-55753** and **CVE-2025-58098**. The first flaw affects `mod_md` ACME certificate renewal handling in Apache HTTP Server versions `2.4.30` through `2.4.65`, where an integer overflow can drive the renewal backoff timer to zero after repeated failures and trigger continuous retry attempts until renewal succeeds. The second flaw affects Apache HTTP Server before `2.4.66` when **Server Side Includes** is enabled with `mod_cgid`, causing the shell-escaped query string to be passed to SSI `#exec cmd="..."` directives. The fixes were shipped through advisories including **RHSA-2026:0009**, **RHSA-2026:0010**, **RHSA-2026:0011**, and **RHSA-2026:0012**, covering RHEL 8.2, 8.4, 8.6, and 8.8 service variants such as AUS, EUS, SAP, Telecommunications, and Advanced Mission Critical Update Support. Updated packages include `httpd`, `mod_md`, `mod_http2`, `mod_ssl`, `mod_ldap`, `mod_proxy_html`, and `mod_session` for supported architectures, while Apache identified version `2.4.66` as the upstream fix level for both issues.
Aug 21, 2026
Red Hat published **Important** security updates for Apache HTTP Server packages across **Red Hat Enterprise Linux 8, 9, and 10** and related JBoss Core Services offerings, addressing multiple upstream `httpd` vulnerabilities. The updates remediate **CVE-2025-65082**, which can let Apache configuration-set variables unexpectedly override server-calculated CGI environment variables, and **CVE-2025-66200**, a `mod_userdir` + `suexec` bypass in which an attacker able to use the `RequestHeader` directive in an `.htaccess` file may cause some CGI scripts to run under an unexpected user ID. Red Hat advisories for RHEL 9 and 10 also include fixes for **CVE-2025-58098**, where Server Side Includes appends the query string to `#exec cmd`, while the RHEL 8 `httpd:2.4` module update additionally addresses **CVE-2025-55753**. The affected Apache HTTP Server ranges extend through **2.4.65**, and upstream guidance points users to **2.4.66** for remediation. Red Hat shipped patched builds including `httpd-2.4.62-7.el9_7.3` for RHEL 9 and `httpd-2.4.63-4.el10_1.3` for RHEL 10, with corresponding package updates across major architectures and lifecycle channels; the RHEL 8 advisory likewise delivers updated `httpd`, `mod_ssl`, `mod_http2`, `mod_md`, and related components. The fixes were released under advisories **RHSA-2025:23732**, **RHSA-2025:23919**, and **RHSA-2025:23932**.
Aug 21, 2026
Red Hat released **JBoss Enterprise Web Server 2.1.1** for RHEL 6 and RHEL 7 to address four Important vulnerabilities in Apache HTTP Server, OpenSSL, and mod_cluster. The update fixes **CVE-2016-5387** (HTTPoxy), where an attacker-supplied `Proxy` HTTP header can set the `HTTP_PROXY` environment variable for CGI scripts and redirect their outbound HTTP requests through an attacker-controlled proxy. The advisories also remediate OpenSSL integer-overflow buffer-overflow flaws **CVE-2016-2105** and **CVE-2016-2106**, which could cause denial of service or potentially code execution, and **CVE-2016-3110**, a crafted mod_cluster MCMP-message flaw that can crash Apache httpd. Red Hat advised affected organizations to back up installations, apply the update, restart JBoss and OpenSSL-linked services, or reboot affected hosts.
Aug 29, 2026