Loading story…
Red Hat released updates for CVE-2026-29167, a use-after-free vulnerability in Apache HTTP Server's mod_ldap when used in per-directory configuration. The flaw affects upstream Apache HTTP Server versions 2.4.0 through 2.4.67 and may allow arbitrary code execution or denial of service; upgrading to Apache HTTP Server 2.4.68 addresses the upstream issue.
For Red Hat Enterprise Linux, RHSA-2026:59347 provides fixed httpd-2.4.62-13.el9_8.6 packages for RHEL 9, while RHSA-2026:60004 provides httpd-2.4.63-13.el10_2.6 for RHEL 10. The updates cover supported x86_64, aarch64, ppc64le, and s390x channels, including applicable EUS, lifecycle, SAP, and RHEL 10.2 offerings; administrators should deploy the updated httpd and mod_ldap packages on affected systems.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:60004 for Red Hat Enterprise Linux 10, supplying fixed httpd and mod_ldap version 2.4.63-13.el10_2.6 packages for CVE-2026-29167.
Red Hat issued RHSA-2026:59347 for Red Hat Enterprise Linux 9, providing fixed httpd 2.4.62-13.el9_8.6 packages to remediate CVE-2026-29167.
Apache HTTP Server version 2.4.68 fixed CVE-2026-29167, a use-after-free vulnerability in mod_ldap per-directory configuration affecting versions 2.4.0 through 2.4.67. The flaw could allow arbitrary code execution or denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `httpd:2.4` across multiple Red Hat Enterprise Linux 8 support channels to remediate two Apache HTTP Server vulnerabilities, **CVE-2025-55753** and **CVE-2025-58098**. The first flaw affects `mod_md` ACME certificate renewal handling in Apache HTTP Server versions `2.4.30` through `2.4.65`, where an integer overflow can drive the renewal backoff timer to zero after repeated failures and trigger continuous retry attempts until renewal succeeds. The second flaw affects Apache HTTP Server before `2.4.66` when **Server Side Includes** is enabled with `mod_cgid`, causing the shell-escaped query string to be passed to SSI `#exec cmd="..."` directives. The fixes were shipped through advisories including **RHSA-2026:0009**, **RHSA-2026:0010**, **RHSA-2026:0011**, and **RHSA-2026:0012**, covering RHEL 8.2, 8.4, 8.6, and 8.8 service variants such as AUS, EUS, SAP, Telecommunications, and Advanced Mission Critical Update Support. Updated packages include `httpd`, `mod_md`, `mod_http2`, `mod_ssl`, `mod_ldap`, `mod_proxy_html`, and `mod_session` for supported architectures, while Apache identified version `2.4.66` as the upstream fix level for both issues.
Aug 21, 2026
Red Hat published **Important** security updates for Apache HTTP Server packages across **Red Hat Enterprise Linux 8, 9, and 10** and related JBoss Core Services offerings, addressing multiple upstream `httpd` vulnerabilities. The updates remediate **CVE-2025-65082**, which can let Apache configuration-set variables unexpectedly override server-calculated CGI environment variables, and **CVE-2025-66200**, a `mod_userdir` + `suexec` bypass in which an attacker able to use the `RequestHeader` directive in an `.htaccess` file may cause some CGI scripts to run under an unexpected user ID. Red Hat advisories for RHEL 9 and 10 also include fixes for **CVE-2025-58098**, where Server Side Includes appends the query string to `#exec cmd`, while the RHEL 8 `httpd:2.4` module update additionally addresses **CVE-2025-55753**. The affected Apache HTTP Server ranges extend through **2.4.65**, and upstream guidance points users to **2.4.66** for remediation. Red Hat shipped patched builds including `httpd-2.4.62-7.el9_7.3` for RHEL 9 and `httpd-2.4.63-4.el10_1.3` for RHEL 10, with corresponding package updates across major architectures and lifecycle channels; the RHEL 8 advisory likewise delivers updated `httpd`, `mod_ssl`, `mod_http2`, `mod_md`, and related components. The fixes were released under advisories **RHSA-2025:23732**, **RHSA-2025:23919**, and **RHSA-2025:23932**.
Aug 21, 2026
Red Hat released updated Apache HTTP Server 2.4 packages for Red Hat Enterprise Linux 7 and Red Hat Software Collections 2 to remediate **CVE-2015-3185**. The flaw affected modules that used the obsolete `ap_some_auth_required()` API: when access was controlled only by a `Require` authorization rule, the API could incorrectly indicate that authentication was required, potentially causing an affected module to grant access that should have been denied. Apache replaced the API with `ap_some_authn_required` and added an `ap_force_authn` hook; the upstream fix shipped in Apache HTTP Server 2.4.16. The Red Hat updates also addressed CVE-2015-3183 request smuggling caused by inconsistent chunked-transfer parsing between httpd and front-end proxies, along with WebSocket Ping denial-of-service and error-response child-process crash flaws in the Software Collections packages. Administrators should apply the updated `httpd` or `httpd24-httpd` packages; fixes were backported and installation restarts the service automatically. Red Hat Enterprise Linux 6 and earlier base httpd packages were not affected by CVE-2015-3185 because they use Apache 2.2 or 2.0.
Aug 29, 2026