CVE-2026-42536

Отчет

In Red Hat Enterprise Linux (RHEL), the httpd package includes mod_xml2enc, which provides encoding support for filters like mod_proxy_html. Because this flaw relies on processing unvetted or untrusted input text lengths, the impact presents a high risk to availability (Denial of Service via worker crashes) and a potential risk to confidentiality if an attacker is capable of executing remote code within the context of the apache or httpd daemon process.

Меры по смягчению последствий

To mitigate this vulnerability, disable the mod_xml2enc module if its functionality for XML internationalization is not essential. This can be done by commenting out the LoadModule xml2enc_module modules/mod_xml2enc.so directive in the Apache HTTP Server configuration. A service restart is required for the change to take effect.

Note: Disabling mod_xml2enc will cause any configurations relying heavily on mod_proxy_html or raw HTML/XML encoding conversions to function incorrectly or fail. Red Hat strongly recommends upgrading to a patched version of httpd as soon as it becomes available for your specific RHEL channel.