Linux · Security advisory · June 24, 2026

RHSA-2026:22140: Security update for 11 packages

RHSA-2026:22140, released June 24, 2026, fixes 6 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0496
92nd percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
httpdRHEL 80:2.4.37-65.module+el8.10.0+24281+ea10630c.8
httpd-develRHEL 80:2.4.37-65.module+el8.10.0+24281+ea10630c.8
httpd-filesystemRHEL 80:2.4.37-65.module+el8.10.0+24281+ea10630c.8
httpd-manualRHEL 80:2.4.37-65.module+el8.10.0+24281+ea10630c.8
httpd-toolsRHEL 80:2.4.37-65.module+el8.10.0+24281+ea10630c.8
mod_http2RHEL 80:1.15.7-10.module+el8.10.0+24315+35fe59d0.5
mod_ldapRHEL 80:2.4.37-65.module+el8.10.0+24281+ea10630c.8
mod_mdRHEL 81:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2
mod_proxy_htmlRHEL 81:2.4.37-65.module+el8.10.0+24281+ea10630c.8
mod_sessionRHEL 80:2.4.37-65.module+el8.10.0+24281+ea10630c.8
mod_sslRHEL 81:2.4.37-65.module+el8.10.0+24281+ea10630c.8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2025-53020 Apache HTTP Server: HTTP/2 DoS by Memory Increase 8.2 0.0496 None reported
High CVE-2026-28780 httpd: Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malic... 9.8 0.0138 None reported
High CVE-2026-33007 Apache HTTP Server: mod_authn_socache crash 8.2 0.0051 None reported
High CVE-2026-34032 Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) 8.2 0.0049 None reported
High CVE-2026-34059 Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() 8.2 0.0039 None reported
High CVE-2026-33857 Apache HTTP Server: Off-by-one OOB reads in AJP getter functions 8.2 0.0039 None reported
Showing 1 to 6 of 6 1