OESA-2026-2319

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2319

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-2319.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-2319

Upstream

CVE-2026-24072

CVE-2026-28780

CVE-2026-29168

CVE-2026-29169

CVE-2026-33006

CVE-2026-34059

Published

2026-05-15T14:01:44Z

Modified

2026-05-15T14:15:11.503001Z

Summary

httpd security update

Details

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-24072)

Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to modproxyajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-28780)

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-29168)

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddav_fs.

The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove moddavlock.(CVE-2026-29169)

A timing attack against modauthdigest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.(CVE-2026-33006)

Buffer Over-read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.(CVE-2026-34059)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:24.03-LTS / httpd

Package

Name: httpd
Purl: pkg:rpm/openEuler/httpd&distro=openEuler-24.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.58-14.oe2403

Ecosystem specific

{
    "aarch64": [
        "httpd-2.4.58-14.oe2403.aarch64.rpm",
        "httpd-debuginfo-2.4.58-14.oe2403.aarch64.rpm",
        "httpd-debugsource-2.4.58-14.oe2403.aarch64.rpm",
        "httpd-devel-2.4.58-14.oe2403.aarch64.rpm",
        "httpd-tools-2.4.58-14.oe2403.aarch64.rpm",
        "mod_ldap-2.4.58-14.oe2403.aarch64.rpm",
        "mod_md-2.4.58-14.oe2403.aarch64.rpm",
        "mod_proxy_html-2.4.58-14.oe2403.aarch64.rpm",
        "mod_session-2.4.58-14.oe2403.aarch64.rpm",
        "mod_ssl-2.4.58-14.oe2403.aarch64.rpm"
    ],
    "src": [
        "httpd-2.4.58-14.oe2403.src.rpm"
    ],
    "x86_64": [
        "httpd-2.4.58-14.oe2403.x86_64.rpm",
        "httpd-debuginfo-2.4.58-14.oe2403.x86_64.rpm",
        "httpd-debugsource-2.4.58-14.oe2403.x86_64.rpm",
        "httpd-devel-2.4.58-14.oe2403.x86_64.rpm",
        "httpd-tools-2.4.58-14.oe2403.x86_64.rpm",
        "mod_ldap-2.4.58-14.oe2403.x86_64.rpm",
        "mod_md-2.4.58-14.oe2403.x86_64.rpm",
        "mod_proxy_html-2.4.58-14.oe2403.x86_64.rpm",
        "mod_session-2.4.58-14.oe2403.x86_64.rpm",
        "mod_ssl-2.4.58-14.oe2403.x86_64.rpm"
    ],
    "noarch": [
        "httpd-filesystem-2.4.58-14.oe2403.noarch.rpm",
        "httpd-help-2.4.58-14.oe2403.noarch.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-2319.json"