Loading story…
Apache HTTP Server developers examined CVE-2013-5704, an issue involving mod_headers and HTTP chunked-transfer trailer fields. Trailer fields could be merged into the inbound request-header collection at an unexpected point in processing because httpd's trailer-handling API was unspecified. The discussion characterized that behavior as incorrect but not inherently an httpd vulnerability; gateway modules were expected to handle trailers safely. mod_proxy acting as a reverse proxy was noted to capture headers before request-body processing and therefore not inadvertently forward the late-added fields.
Red Hat's published lifecycle policies define the support conditions relevant to applying security fixes across RHEL and Application Services deployments. RHEL 8, 9, and 10 receive fixes for Critical, Important, and qualifying Moderate CVEs during supported phases, while Application Services customers generally must run the current minor, micro, or cumulative-patch release to receive current fixes. Extended support offerings can continue limited coverage after normal maintenance phases, but the policies do not identify a specific active remediation or advisory for CVE-2013-5704.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat removed Open Liberty from the Application Services Product Update and Support Policy page because IBM assumed responsibility for the product.
Red Hat added a new one-year Extended Life Support 2 phase for Red Hat Fuse.
Red Hat extended every lifecycle phase for its Red Hat build of Apache Camel by one year.
Apache Jsvc 1.4.0 reached general availability. Its Full Support was defined to end when the next Jsvc minor version ships or support for the related JBoss Web Server ends, whichever occurs first.
Red Hat changed the Red Hat build of Apache Camel 4 end-of-life date from October 2026 to October 2028.
Apache HTTP Server developers discussed CVE-2013-5704, in which unspecified handling of chunked-transfer trailer fields could add headers to r->headers_in unexpectedly. Participants agreed the behavior was incorrect, while Joe Orton argued it was not inherently an httpd security issue and a separate thread was restarted to pursue a fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcemarc.info
Open sourcemartin.swende.se
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2016:0062** for JBoss Web Server 2.1.0 to address `CVE-2015-3183`, `CVE-2013-5704`, and `CVE-2012-0876`. In particular, `CVE-2013-5704` lets an unauthenticated remote client add HTTP Trailer headers to chunked requests after other modules have processed headers, potentially bypassing restrictions enforced with `mod_headers`. The update also addresses HTTP request-smuggling risk and an Expat XML parsing flaw that could enable CPU-exhaustion denial of service; affected users were advised to apply the update and restart the service. HP also issued **HPSBUX03512 (SSRT102254)** for HP-UX Web Server Suite running Apache, citing remote denial of service, access-control bypass, unauthorized modification, information disclosure, and SSL/TLS weaknesses including Logjam and Bar Mitzvah. HP identified Web Server Suite 2.2.15.21 Apache on HP-UX 11i v2 as affected and directed administrators to install updated packages, including Apache `B.2.2.15.18` or later and, where applicable, Tomcat `C.6.0.35.01` or later.
Aug 29, 2026
Red Hat released updated Apache HTTP Server 2.4 packages for Red Hat Enterprise Linux 7 and Red Hat Software Collections 2 to remediate **CVE-2015-3185**. The flaw affected modules that used the obsolete `ap_some_auth_required()` API: when access was controlled only by a `Require` authorization rule, the API could incorrectly indicate that authentication was required, potentially causing an affected module to grant access that should have been denied. Apache replaced the API with `ap_some_authn_required` and added an `ap_force_authn` hook; the upstream fix shipped in Apache HTTP Server 2.4.16. The Red Hat updates also addressed CVE-2015-3183 request smuggling caused by inconsistent chunked-transfer parsing between httpd and front-end proxies, along with WebSocket Ping denial-of-service and error-response child-process crash flaws in the Software Collections packages. Administrators should apply the updated `httpd` or `httpd24-httpd` packages; fixes were backported and installation restarts the service automatically. Red Hat Enterprise Linux 6 and earlier base httpd packages were not affected by CVE-2015-3185 because they use Apache 2.2 or 2.0.
Aug 29, 2026
Red Hat released **Important** security updates for `httpd:2.4` across multiple Red Hat Enterprise Linux 8 support channels to remediate two Apache HTTP Server vulnerabilities, **CVE-2025-55753** and **CVE-2025-58098**. The first flaw affects `mod_md` ACME certificate renewal handling in Apache HTTP Server versions `2.4.30` through `2.4.65`, where an integer overflow can drive the renewal backoff timer to zero after repeated failures and trigger continuous retry attempts until renewal succeeds. The second flaw affects Apache HTTP Server before `2.4.66` when **Server Side Includes** is enabled with `mod_cgid`, causing the shell-escaped query string to be passed to SSI `#exec cmd="..."` directives. The fixes were shipped through advisories including **RHSA-2026:0009**, **RHSA-2026:0010**, **RHSA-2026:0011**, and **RHSA-2026:0012**, covering RHEL 8.2, 8.4, 8.6, and 8.8 service variants such as AUS, EUS, SAP, Telecommunications, and Advanced Mission Critical Update Support. Updated packages include `httpd`, `mod_md`, `mod_http2`, `mod_ssl`, `mod_ldap`, `mod_proxy_html`, and `mod_session` for supported architectures, while Apache identified version `2.4.66` as the upstream fix level for both issues.
Aug 21, 2026