{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 5 is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.\n\nThis release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 5 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.\n\nSecurity Fix(es):\n\n* jbcs-httpd24-httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)\n* jbcs-httpd24-httpd: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072)\n* jbcs-httpd24-mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service (CVE-2026-48913)\n* mod_http2.so: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service (CVE-2026-48913)\n* jbcs-httpd24-httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)\n* jbcs-httpd24-httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535)\n* jbcs-httpd24-httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)\n* jbcs-httpd24-httpd: SSRF in Apache HTTP Server with mod_proxy loaded (CVE-2024-43204)\n* jbcs-httpd24-httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)\n* jbcs-httpd24-httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)\n* jbcs-httpd24-httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)\n* jbcs-httpd24-httpd: Apache HTTP Server - Cross-site scripting in mod_proxy_ftp HTML directory list generation (CVE-2026-29170)\n* jbcs-httpd24-httpd: jbcs-httpd24-mod_http2: Apache HTTP Server - Out-of-bounds Read in mod_headers and mod_mime with multiple response languages (CVE-2026-43951)\n* jbcs-httpd24-httpd: Apache HTTP Server - Improper Privilege Management allowing .htaccess authors to read files as httpd user (CVE-2026-44119)\n* jbcs-httpd24-httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)\n* jbcs-httpd24-httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)\n* jbcs-httpd24-httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)\n\nA Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:56868",
        "url": "https://access.redhat.com/errata/RHSA-2026:56868"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_5_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_5_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2374549",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374549"
      },
      {
        "category": "external",
        "summary": "2374553",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374553"
      },
      {
        "category": "external",
        "summary": "2464941",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464941"
      },
      {
        "category": "external",
        "summary": "2486394",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486394"
      },
      {
        "category": "external",
        "summary": "2486395",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486395"
      },
      {
        "category": "external",
        "summary": "2486397",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486397"
      },
      {
        "category": "external",
        "summary": "2486399",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486399"
      },
      {
        "category": "external",
        "summary": "2486402",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486402"
      },
      {
        "category": "external",
        "summary": "2486405",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486405"
      },
      {
        "category": "external",
        "summary": "2486406",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486406"
      },
      {
        "category": "external",
        "summary": "2486411",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486411"
      },
      {
        "category": "external",
        "summary": "2486414",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486414"
      },
      {
        "category": "external",
        "summary": "2486415",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486415"
      },
      {
        "category": "external",
        "summary": "2486416",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486416"
      },
      {
        "category": "external",
        "summary": "2486419",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486419"
      },
      {
        "category": "external",
        "summary": "JBCS-2284",
        "url": "https://issues.redhat.com/browse/JBCS-2284"
      },
      {
        "category": "external",
        "summary": "JBCS-2285",
        "url": "https://issues.redhat.com/browse/JBCS-2285"
      },
      {
        "category": "external",
        "summary": "JBCS-2286",
        "url": "https://issues.redhat.com/browse/JBCS-2286"
      },
      {
        "category": "external",
        "summary": "JBCS-2287",
        "url": "https://issues.redhat.com/browse/JBCS-2287"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56868.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update",
    "tracking": {
      "current_release_date": "2026-09-01T20:02:57+00:00",
      "generator": {
        "date": "2026-09-01T20:02:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:56868",
      "initial_release_date": "2026-08-19T13:34:28+00:00",
      "revision_history": [
        {
          "date": "2026-08-19T13:34:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-19T18:13:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-01T20:02:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Core Services on RHEL 8",
                "product": {
                  "name": "Red Hat JBoss Core Services on RHEL 8",
                  "product_id": "8Base-JBCS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_core_services:1::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Core Services"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
                "product": {
                  "name": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
                  "product_id": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.62-16.el8jbcs?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
                "product": {
                  "name": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
                  "product_id": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@2.0.29-13.el8jbcs?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
                "product": {
                  "name": "jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
                  "product_id": "jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.50-17.redhat_1.el8jbcs?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
                "product": {
                  "name": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
                  "product_id": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.28-19.el8jbcs?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
                  "product_id": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_cluster@1.3.22-12.el8jbcs?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
                "product": {
                  "name": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
                  "product_id": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.6-19.el8jbcs?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.62-16.el8jbcs?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.62-16.el8jbcs?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools-debuginfo@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap-debuginfo@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html-debuginfo@2.4.62-16.el8jbcs?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session-debuginfo@2.4.62-16.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl-debuginfo@2.4.62-16.el8jbcs?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@2.0.29-13.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2-debuginfo@2.0.29-13.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.50-17.redhat_1.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24-debuginfo@1.2.50-17.redhat_1.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.28-19.el8jbcs?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md-debuginfo@2.4.28-19.el8jbcs?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_cluster@1.3.22-12.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_cluster-debuginfo@1.3.22-12.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.6-19.el8jbcs?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
                  "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.6-19.el8jbcs?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
                "product": {
                  "name": "jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
                  "product_id": "jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.62-16.el8jbcs?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src"
        },
        "product_reference": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch"
        },
        "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src"
        },
        "product_reference": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src"
        },
        "product_reference": "jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src"
        },
        "product_reference": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src"
        },
        "product_reference": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8",
          "product_id": "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
        "relates_to_product_reference": "8Base-JBCS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-42516",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2025-06-24T12:01:28.570000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2374549"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a \"complete\" fix for CVE-2023-38709.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: incomplete fix for CVE-2023-38709",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable by a malicious backend or a malicious application, but may also affect forward proxy configurations.\n\nThis issue is classified as a Moderate vulnerability because successful exploitation requires a highly specific and constrained setup. Namely, the attacker must already have the ability to influence backend responses\u2014such as injecting malicious headers like Content-Type or Content-Encoding\u2014which typically implies a compromised or poorly controlled upstream service. In properly configured systems, frontend servers like Apache sanitize or strictly validate backend output, limiting exposure. Furthermore, HTTP response splitting does not inherently lead to remote code execution or privilege escalation on the server itself; instead, its effects are typically confined to manipulating client-side behavior such as caching or redirection.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-42516"
        },
        {
          "category": "external",
          "summary": "RHBZ#2374549",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374549"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-42516",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-42516"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-42516",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42516"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2025-07-14T07:13:28.880000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: incomplete fix for CVE-2023-38709"
    },
    {
      "cve": "CVE-2024-43204",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2025-06-24T12:09:27.933000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2374553"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A Server-side request forgery (SSRF) vulnerability exists in Apache httpd when the server has mod_proxy loaded and is configured with mod_headers to modify the Content-Type header in the HTTP request or response using a value supplied by the user. Under this configuration, this flaw allows an attacker to craft specially crafted requests to manipulate the Content-Type header and trigger outbound requests to arbitrary attacker-controlled URLs via proxy. The vulnerability stems from inadequate input validation and unsafe header manipulation, ultimately allowing an attacker to influence server-side network behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: SSRF in Apache HTTP Server with mod_proxy loaded",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation requires a non-default and uncommon server configuration where mod_headers is configured to modify the Content-Type request or a response header with a value provided in the HTTP request.\n\nThis issue is rated as a Moderate vulnerability primarily due to its reliance on a non-default and uncommon server configuration, which significantly limits its exploitability. Specifically, successful exploitation requires the Apache HTTP Server to have both mod_proxy and mod_headers enabled, and for mod_headers to be explicitly misconfigured to set or modify the Content-Type header using unvalidated user input\u2014a rare and generally discouraged setup. Moreover, the SSRF does not result in information disclosure, privilege escalation, or code execution, but merely allows outbound connections from the server to attacker-controlled endpoints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-43204"
        },
        {
          "category": "external",
          "summary": "RHBZ#2374553",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374553"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-43204",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-43204"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43204",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43204"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2025-07-14T07:14:13.801000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: SSRF in Apache HTTP Server with mod_proxy loaded"
    },
    {
      "cve": "CVE-2026-24072",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-05-04T13:01:13.896013+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464941"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This escalation of privilege vulnerability allows local attackers, specifically those with the ability to author .htaccess files, to read sensitive files. This flaw enables unauthorized access to files with the privileges of the httpd user, potentially leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24072"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464941",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464941"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24072",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24072"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24072",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24072"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T12:37:57.673000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "To prevent local users from exploiting this flaw via .htaccess file manipulation, configure Apache HTTP Server to disable .htaccess overrides. Set `AllowOverride None` within the main server configuration or relevant `\u003cDirectory\u003e` blocks. This restricts the ability of local users to alter server settings. After applying this change, the `httpd` service must be reloaded or restarted for the new configuration to take effect.\n\nExample configuration:\n```\n\u003cDirectory \"/var/www/html\"\u003e\n    AllowOverride None\n\u003c/Directory\u003e\n```\nTo apply changes, reload the service:\n`sudo systemctl reload httpd`\nOr restart the service:\n`sudo systemctl restart httpd`",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation"
    },
    {
      "cve": "CVE-2026-29167",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-06-08T16:01:30.220956+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server when using the `mod_ldap` module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service (DoS) due to improper memory handling. This could lead to system instability or unauthorized control over the affected server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "CISA\u0027s 9.8 is a mechanical worst-case UAF score. Their vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H \u2014 they\u0027re treating it as: \"network-facing service, memory corruption primitive, assume RCE.\" This is how CISA-ADP routinely scores any UAF in a network daemon. They don\u0027t analyze actual exploitability; they score the theoretical ceiling of the vulnerability class.\n\nApache\u0027s LOW reflects what actually happens. \n\n1. Trigger is narrow \u2014 mod_ldap must be loaded (not default) AND configured in per-directory context (\u003cDirectory\u003e, \u003cLocation\u003e, .htaccess). Server-wide LDAP config doesn\u0027t trigger it. This is an unusual configuration pattern.\n2. UAF in config merging, not request handling \u2014 the freed memory is in the per-directory configuration merge path, which constrains the timing window and what objects occupy the freed allocation. This isn\u0027t a heap spray-friendly UAF in a hot request path.\n3. httpd\u0027s process model kills RCE reliability \u2014 prefork uses separate processes (crash = one child dies, parent respawns), worker/event have per-process address space. Turning a UAF into reliable RCE against httpd is substantially harder than against a single-threaded daemon with a predictable heap layout.\n4. Realistic impact is DoS \u2014 the freed pointer will most likely cause a segfault (child crash), not a controlled write primitive. The parent process respawns workers, so even the DoS is transient.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29167"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29167",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29167"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29167",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29167"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:07:59.231000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "upgrade apache web server to 2.4.68",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration"
    },
    {
      "cve": "CVE-2026-29170",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-06-08T16:02:43.595491+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486419"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server, specifically within the `mod_proxy_ftp` module. This cross-site scripting (XSS) vulnerability occurs during the generation of HTML directory lists when the server is configured to list FTP directory contents via either a forward or reverse proxy. An attacker could exploit this by injecting malicious scripts into web pages, which could lead to information disclosure or unauthorized actions when viewed by other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact cross-site scripting (XSS) vulnerability in Apache HTTP Server\u0027s `mod_proxy_ftp` module requires specific server configurations to be exploitable. The flaw occurs when `mod_proxy_ftp` is enabled and configured to list FTP directory contents via a proxy, which is not a default setup in Red Hat Enterprise Linux. Successful exploitation depends on a user viewing a specially crafted web page, potentially leading to information disclosure or unauthorized actions within the user\u0027s browser context.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29170"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486419",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486419"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29170",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29170"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29170",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29170"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:10:09.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation"
    },
    {
      "cve": "CVE-2026-34355",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:02:27.677660+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486414"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in `mod_proxy_html` within the Apache HTTP Server allows an untrusted backend to trigger a buffer overflow. This could lead to a security bypass or arbitrary code execution, posing a significant risk in environments where `httpd` is configured with untrusted backend services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486414",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486414"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34355"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:20:30.900000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "Disable the `mod_proxy_html` module if it is not essential for your Apache HTTP Server configuration. If `mod_proxy_html` is required, restrict its use to trusted backend servers only, employing network segmentation and access controls. After modifying the configuration, reload the httpd service for changes to apply, which may cause a brief service interruption.\n\nSteps to disable:\nOpen /etc/httpd/conf.modules.d/00-proxy.conf.\nAdd a # to comment out the line: LoadModule proxy_html_module modules/mod_proxy_html.so\nVerify configuration syntax: apachectl configtest\nApply the change gracefully: systemctl reload httpd",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass"
    },
    {
      "cve": "CVE-2026-34356",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:01:32.651836+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486395"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie* directives. This could lead to a denial of service (DoS) condition, making the server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in Apache could allow a malicious backend server to crash your web server, making it unavailable to users. Your system is only at risk if you use Apache to forward traffic to untrusted or unverified backend systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34356"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486395",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486395"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34356",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34356"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34356",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34356"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:12:21.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "To prevent this denial-of-service flaw, ensure your Apache proxy rules only connect to highly trusted backend servers. If you must proxy traffic to unverified or external backends, disable the cookie-rewriting features.\n\nSteps to Mitigate:\n\nOpen your Apache configuration file (e.g., /etc/httpd/conf/httpd.conf).\nLocate and comment out any ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath lines pointing to untrusted backends by adding a # at the start of the line.\nTest your syntax: apachectl configtest\nApply changes gracefully: systemctl reload httpd\nNote: This may cause a brief service interruption.",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers"
    },
    {
      "cve": "CVE-2026-42535",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-08T16:02:04.647650+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486406"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `mod_dav_fs` module of Apache HTTP Server. A WebDAV (Web Distributed Authoring and Versioning) content author could exploit a path handling issue to directly manipulate trusted DAV property databases. This manipulation could potentially lead to child process crashes, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42535"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486406",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486406"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42535",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42535"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42535",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42535"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:14:49.189000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue"
    },
    {
      "cve": "CVE-2026-42536",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:02:19.284204+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server, specifically within the mod_xml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service, information disclosure, or possibly arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat Enterprise Linux (RHEL), the httpd package includes mod_xml2enc, which provides encoding support for filters like mod_proxy_html. Because this flaw relies on processing unvetted or untrusted input text lengths, the impact presents a high risk to availability (Denial of Service via worker crashes) and a potential risk to confidentiality if an attacker is capable of executing remote code within the context of the apache or httpd daemon process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42536"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42536",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42536"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42536",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42536"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:23:46.290000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, disable the `mod_xml2enc` module if its functionality for XML internationalization is not essential. This can be done by commenting out the `LoadModule xml2enc_module modules/mod_xml2enc.so` directive in the Apache HTTP Server configuration. A service restart is required for the change to take effect.\n\n```bash\n# Edit the Apache configuration file, e.g., /etc/httpd/conf.modules.d/00-base.conf\n# Comment out the line:\n# LoadModule xml2enc_module modules/mod_xml2enc.so\n\n# Reload the httpd service\nsudo systemctl reload httpd\n```\n\n*Note: Disabling `mod_xml2enc` will cause any configurations relying heavily on `mod_proxy_html` or raw HTML/XML encoding conversions to function incorrectly or fail. Red Hat strongly recommends upgrading to a patched version of `httpd` as soon as it becomes available for your specific RHEL channel.*",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc"
    },
    {
      "cve": "CVE-2026-43951",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486415"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when `mod_headers` and `mod_mime` are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Apache HTTP Server arises from an out-of-bounds read when both `mod_headers` and `mod_mime` modules are active and configured for multiple response languages. While this configuration is not universally enabled by default in Red Hat products, affected systems could be vulnerable to information disclosure or denial of service if these specific modules and language settings are in use. Exploitation requires a remote attacker to trigger this specific module interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43951"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486415",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486415"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43951",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43951"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43951",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43951"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:16:14.594000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "- Those who do not require multi-language response headers can remove or disable the `mod_headers` and `mod_mime` modules, or remove Content-Language directives from their configuration. \n- Systems not using these modules in combination are not affected.",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime"
    },
    {
      "cve": "CVE-2026-44119",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-06-08T16:02:34.964516+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486416"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This improper privilege management vulnerability allows local .htaccess authors to read files with the privileges of the httpd user. This could lead to unauthorized information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44119"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486416",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486416"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44119",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44119"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44119",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44119"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:17:31.939000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges"
    },
    {
      "cve": "CVE-2026-44185",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-08T16:01:37.898883+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486397"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A critical buffer over-read flaw in Apache HTTP Server occurs when it performs outbound OCSP requests. If a server connects to an attacker-controlled OCSP responder, a remote attacker can leak sensitive memory data or trigger a denial of service (DoS). This risk depends entirely on the server\u0027s OCSP configuration and endpoint trustworthiness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44185"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486397",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486397"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44185",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44185"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44185",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44185"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:22:11.809000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that Apache HTTP Server is configured to only communicate with trusted OCSP responders. If OCSP validation or stapling is not a critical requirement for your deployment, consider disabling it. This can be achieved by adjusting mod_ssl directives in your Apache HTTP Server configuration. \n\nFor example, add or modify the following lines:\n\n~~~\nSSLOCSPEnable off\nSSLUseStapling off\n~~~\n\nAfter modifying the configuration, reload the httpd service for the changes to take effect safely without interrupting active connections:\n\n~~~\nsudo systemctl reload httpd\n~~~",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server"
    },
    {
      "cve": "CVE-2026-44186",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-06-08T16:01:53.173507+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486402"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `mod_proxy_ftp` module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol (FTP) server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service (DoS) for the affected server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A loop with an unreachable exit condition flaw was found in the mod_proxy_ftp module of the Apache HTTP Server. A remote attacker could exploit this vulnerability by tricking the server into connecting to a malicious or compromised backend FTP server, causing the proxy_ftp_handler component to enter an infinite loop. This results in CPU exhaustion and a denial of service (DoS) condition on the affected system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486402",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486402"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44186"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:11:12.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, you can disable the `mod_proxy_ftp` module if your environment does not require it.\n\n#### **Step 1: Disable the Module**\n\nOpen your Apache HTTP Server configuration file (commonly located at `/etc/httpd/conf.modules.d/00-proxy.conf` or `/etc/httpd/conf/httpd.conf`) and comment out or remove the following line:\n\n```\n# LoadModule proxy_ftp_module modules/mod_proxy_ftp.so\n```\n#### **Step 2: Restart the Service**\n\nRestart the `httpd` service to apply the configuration changes:\n```\nsystemctl restart httpd\n```\n**Note:** Disabling this module may impact applications or services that rely on Apache\u0027s FTP proxy functionality.",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server"
    },
    {
      "cve": "CVE-2026-44631",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "discovery_date": "2026-06-08T16:01:43.891910+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486399"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server\u0027s configuration. An attacker could potentially exploit this to cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Server: Denial of Service via crafted regular expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact buffer underwrite flaw in Apache HTTP Server can lead to a denial of service. The vulnerability occurs when processing specially crafted regular expressions within the server\u0027s configuration. Exploitation requires a high attack complexity, indicating that specific conditions or a complex attack vector are necessary, thereby limiting the practical risk in typical Red Hat deployments where configuration changes are tightly controlled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486399",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486399"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44631"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:19:23.570000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "Only loadtrustedApache configuration; the bug triggers oncrafted regexin config at start/reload (DirectoryMatch,Directory ~,ProxyMatch, etc.).\nKeep AllowOverride None where possible so untrusted users cannot inject regex via .htaccess.\nRestrict who can change httpdconfig and reload the service.",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Server: Denial of Service via crafted regular expressions"
    },
    {
      "cve": "CVE-2026-48913",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-06-08T16:02:01.682142+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486405"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache HTTP Server\u0027s mod_http2 module. This vulnerability, known as a Use After Free, occurs when the server\u0027s file handles are exhausted. An attacker could potentially exploit this to cause a denial of service or, in some cases, execute arbitrary code, leading to system compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A use-after-free vulnerability exists in the Apache HTTP Server mod_http2 module when system file handles are exhausted. A remote attacker could trigger this flaw via HTTP/2 requests to cause a denial of service (crash) or memory corruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
          "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
          "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
          "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48913"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486405",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486405"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48913",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48913"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48913",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48913"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-06-08T15:24:52.573000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:34:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56868"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the `mod_http2` module if HTTP/2 protocol support is not required. This can be achieved by commenting out or removing the `LoadModule http2_module modules/mod_http2.so` line in the Apache HTTP Server configuration file (e.g., `/etc/httpd/conf.modules.d/00-base.conf` or similar). \n\nAfter modifying the configuration, the httpd service must be restarted for the changes to take effect. This action may impact services relying on HTTP/2.",
          "product_ids": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-httpd-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-devel-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-manual-0:2.4.62-16.el8jbcs.noarch",
            "8Base-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-httpd-tools-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_http2-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:2.0.29-13.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-0:1.2.50-17.redhat_1.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_jk-ap24-debuginfo-0:1.2.50-17.redhat_1.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ldap-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_md-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.4.28-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_cluster-debuginfo-0:1.3.22-12.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_proxy_html-debuginfo-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.src",
            "8Base-JBCS:jbcs-httpd24-mod_security-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.6-19.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_session-debuginfo-0:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-1:2.4.62-16.el8jbcs.x86_64",
            "8Base-JBCS:jbcs-httpd24-mod_ssl-debuginfo-1:2.4.62-16.el8jbcs.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service."
    }
  ]
}