Описание
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when mod_headers and mod_mime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service.
Отчет
This Moderate impact vulnerability in Apache HTTP Server arises from an out-of-bounds read when both mod_headers and mod_mime modules are active and configured for multiple response languages. While this configuration is not universally enabled by default in Red Hat products, affected systems could be vulnerable to information disclosure or denial of service if these specific modules and language settings are in use. Exploitation requires a remote attacker to trigger this specific module interaction.
Меры по смягчению последствий
- Those who do not require multi-language response headers can remove or disable the
mod_headersandmod_mimemodules, or remove Content-Language directives from their configuration. - Systems not using these modules in combination are not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | httpd | Out of support scope | ||
| Red Hat Enterprise Linux 7 | httpd | Out of support scope | ||
| Red Hat JBoss Core Services | mod_http2.so | Fix deferred | ||
| JBoss Core Services for RHEL 8 | jbcs-httpd24-httpd | Fixed | RHSA-2026:56868 | 19.08.2026 |
| JBoss Core Services for RHEL 8 | jbcs-httpd24-mod_http2 | Fixed | RHSA-2026:56868 | 19.08.2026 |
| JBoss Core Services for RHEL 8 | jbcs-httpd24-mod_jk | Fixed | RHSA-2026:56868 | 19.08.2026 |
| JBoss Core Services for RHEL 8 | jbcs-httpd24-mod_md | Fixed | RHSA-2026:56868 | 19.08.2026 |
| JBoss Core Services for RHEL 8 | jbcs-httpd24-mod_proxy_cluster | Fixed | RHSA-2026:56868 | 19.08.2026 |
| JBoss Core Services for RHEL 8 | jbcs-httpd24-mod_security | Fixed | RHSA-2026:56868 | 19.08.2026 |
| Red Hat Enterprise Linux 10 | httpd | Fixed | RHSA-2026:34109 | 01.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_header ...
Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
EPSS
6.5 Medium
CVSS3