Linux · Security advisory · July 22, 2026
RHSA-2026:42828: Security update for 11 packages
RHSA-2026:42828, released July 22, 2026, fixes 9 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0116
67th percentile
Priority of the 9 CVEs
Patch now 0
Urgent 0
High 9
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| httpd | RHEL 8 | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| httpd-devel | RHEL 8 | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| httpd-filesystem | RHEL 8 | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| httpd-manual | RHEL 8 | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| httpd-tools | RHEL 8 | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| mod_http2 | RHEL 8 | 0:1.15.7-10.module+el8.10.0+24521+219dcfc5.7 |
| mod_ldap | RHEL 8 | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| mod_md | RHEL 8 | 1:2.0.8-8.module+el8.10.0+23815+1b5e1c66.2 |
| mod_proxy_html | RHEL 8 | 1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| mod_session | RHEL 8 | 0:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
| mod_ssl | RHEL 8 | 1:2.4.37-65.module+el8.10.0+24521+219dcfc5.9 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-34355 | Apache HTTP Server: mod_proxy_html buffer overflow | 7.7 | 0.0116 | None reported | |
| High | CVE-2026-42536 | Apache HTTP Server: mod_xml2enc heap overflow | 7.7 | 0.0102 | None reported | |
| High | CVE-2024-42516 | Apache HTTP Server: HTTP response splitting | 7.7 | 0.0082 | None reported | |
| High | CVE-2026-44185 | Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` | 7.7 | 0.0074 | None reported | |
| High | CVE-2026-34356 | Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow | 7.7 | 0.0071 | None reported | |
| High | CVE-2026-29169 | Apache HTTP Server: mod_dav_lock indirect lock crash | 7.7 | 0.0059 | None reported | |
| High | CVE-2026-44186 | Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp | 7.7 | 0.0058 | None reported | |
| High | CVE-2026-43951 | Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash | 7.7 | 0.0055 | None reported | |
| High | CVE-2026-44631 | Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow | 9.8 | 0.0050 | None reported |
Showing 1 to 9 of 9
1