Linux · Security advisory · July 21, 2026
RHSA-2026:41906: Security update for 11 packages
RHSA-2026:41906, released July 21, 2026, fixes 13 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
13
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0116
67th percentile
Priority of the 13 CVEs
Patch now 0
Urgent 0
High 13
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| httpd | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| httpd-core | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| httpd-devel | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| httpd-filesystem | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| httpd-manual | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| httpd-tools | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| mod_ldap | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| mod_lua | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| mod_proxy_html | RHEL 9 | 1:2.4.62-13.el9_8.5 |
| mod_session | RHEL 9 | 0:2.4.62-13.el9_8.5 |
| mod_ssl | RHEL 9 | 1:2.4.62-13.el9_8.5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-34355 | Apache HTTP Server: mod_proxy_html buffer overflow | 7.7 | 0.0116 | None reported | |
| High | CVE-2026-42536 | Apache HTTP Server: mod_xml2enc heap overflow | 7.7 | 0.0102 | None reported | |
| High | CVE-2024-42516 | Apache HTTP Server: HTTP response splitting | 7.7 | 0.0082 | None reported | |
| High | CVE-2026-44185 | Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` | 7.7 | 0.0074 | None reported | |
| High | CVE-2026-34356 | Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow | 7.7 | 0.0071 | None reported | |
| High | CVE-2026-24072 | Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr | 8.8 | 0.0065 | None reported | |
| High | CVE-2026-29169 | Apache HTTP Server: mod_dav_lock indirect lock crash | 7.7 | 0.0059 | None reported | |
| High | CVE-2026-44186 | Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp | 7.7 | 0.0058 | None reported | |
| High | CVE-2026-33006 | Apache HTTP Server: mod_auth_digest timing attack | 8.1 | 0.0056 | None reported | |
| High | CVE-2026-43951 | Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash | 7.7 | 0.0055 | None reported | |
| High | CVE-2026-42535 | Apache HTTP Server: mod_dav_fs protected directory access | 9.1 | 0.0054 | None reported | |
| High | CVE-2026-44631 | Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow | 9.8 | 0.0050 | None reported | |
| High | CVE-2026-44119 | Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules | 7.7 | 0.0018 | None reported |
Showing 1 to 13 of 13
1