| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: httpd-tools | Distribution: AlmaLinux |
| Version: 2.4.63 | Vendor: AlmaLinux |
| Release: 13.el10_2.8 | Build date: Mon Oct 26 14:16:25 2026 |
| Group: Unspecified | Build host: ppc64le-builder02.almalinux.org |
| Size: 452609 | Source RPM: httpd-2.4.63-13.el10_2.8.src.rpm |
| Packager: AlmaLinux Packaging Team <packager@almalinux.org> | |
| Url: https://httpd.apache.org/ | |
| Summary: Tools for use with the Apache HTTP Server | |
The httpd-tools package contains tools which can be used with the Apache HTTP Server.
Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94)
* Wed Oct 14 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13.8
- Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host
header in mod_vhost_alias (CVE-2026-63292)
- Resolves: RHEL-280355 - httpd: Denial of Service via mod_rewrite
lookahead (CVE-2026-56154)
* Fri Oct 02 2026 Joe Orton <jorton@redhat.com> - 2.4.63-13.7
- Resolves: RHEL-275545 CVE-2026-48005 httpd: Denial of service via forged
Authorization headers in mod_auth_digest
- Resolves: RHEL-275331 CVE-2026-73636 httpd: Authentication bypass via
credential replay in mod_auth_digest
- Resolves: RHEL-275222 CVE-2026-73637 httpd: Authentication state corruption
via concurrent Digest authentication requests
- Resolves: RHEL-275315 CVE-2026-56153 httpd: Denial of Service via heap-based
buffer overflow in mod_charset_lite
- Resolves: RHEL-275302 CVE-2026-46729 httpd: mod_heartmonitor: Denial of
Service via NULL pointer dereference
- Resolves: RHEL-275269 CVE-2026-63045 httpd: unauthorized connection to
arbitrary hosts via crafted FTP PASV response
- Resolves: RHEL-275253 CVE-2026-63292 httpd: Arbitrary code execution via
oversized Host header in mod_vhost_alias
- Resolves: RHEL-275238 CVE-2026-63686 httpd: Denial of Service via charset
conversion failure in mod_xml2enc
- Resolves: RHEL-275208 CVE-2026-93546 httpd: Denial of Service via integer
overflow in mod_dav_fs
- Resolves: RHEL-275169 CVE-2026-63718 httpd: HTTP response smuggling via
crafted Transfer-Encoding response in mod_proxy_uwsgi
* Thu Aug 20 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13.6
- Resolves: RHEL-190812 - httpd: Apache HTTP Server: Arbitrary code execution
or denial of service via use-after-free in mod_ldap per-directory
configuration (CVE-2026-29167)
* Thu Jul 09 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13.5
- Resolves: RHEL-192750 - mod_proxy_html regression in CVE-2026-34355 fix
* Tue Jun 23 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13.4
- Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)
- Resolves: RHEL-186195 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via untrusted content in mod_xml2enc (CVE-2026-42536)
- Resolves: RHEL-186182 - httpd: Apache HTTP Server: Buffer overflow in
mod_proxy_html allows security bypass (CVE-2026-34355)
- Resolves: RHEL-186158 - httpd: Apache HTTP Server: Buffer Over-read via
outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
- Resolves: RHEL-184305 - httpd: Apache HTTP Server: Denial of Service via
crafted regular expressions (CVE-2026-44631)
- Resolves : RHEL-182581 - httpd: incomplete fix for
CVE-2023-38709 (CVE-2024-42516)
- Resolves: RHEL-175621 - httpd: NULL pointer dereference via specially crafted
request (CVE-2026-29169)
- Also addresses CVE-2026-44119, CVE-2026-44186, CVE-2026-42535,
CVE-2026-24072, CVE-2026-33006, CVE-2026-43951
* Mon May 11 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13.1
- Resolves: RHEL-173549 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175065 - httpd: NULL pointer dereference can cause a child
process crash (CVE-2026-33007)
- Resolves: RHEL-175095 - httpd: off-by-one out-of-bounds reads in AJP getter
functions (CVE-2026-33857)
- Resolves: RHEL-175039 - httpd: heap-based buffer over-read due to missing
null-termination check (CVE-2026-34032)
- Resolves: RHEL-175050 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
* Thu Feb 12 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13
- Resolves: RHEL-145713 - [RFE] Need miliseconds time stamp in ErrorLogFormat
* Fri Jan 02 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-12
- Resolves: RHEL-135053 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
via AllowOverride FileInfo (CVE-2025-66200)
- Resolves: RHEL-135036 - httpd: Apache HTTP Server: CGI environment variable
override (CVE-2025-65082)
- Resolves: RHEL-134468 - httpd: Apache HTTP Server: Server Side Includes adds
query string to #exec cmd=... (CVE-2025-58098)
* Thu Dec 18 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-11
- Resolves: RHEL-131829 - Fix error page messaging when error handling fails
* Thu Nov 06 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-10
- Resolves: RHEL-125880 - mod_ssl: allow more fine grained SSL SNI vhost check
to avoid unnecessary 421 errors after CVE-2025-23048 fix
* Fri Oct 24 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-6
- Resolves: RHEL-122290 - mod_proxy_hcheck may stop healthchecks after a child
process is reclaimed
* Mon Sep 08 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-5
- Resolves: RHEL-92663 - Image mode: The dir /var/www is not created when
updating system in image mode
* Sat Aug 16 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-4
- Resolves: RHEL-99945 - httpd: HTTP Session Hijack via a TLS
upgrade (CVE-2025-49812)
- Resolves: RHEL-99962 - httpd: access control bypass by trusted clients
is possible using TLS 1.3 session resumption (CVE-2025-23048)
- Resolves: RHEL-99970 - httpd: insufficient escaping of user-supplied
data in mod_ssl (CVE-2024-47252)
- Resolves: RHEL-103489 - stickysession field does not work when
specifying it in the query parameter after upgrade to 9.5
* Mon Jul 28 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-3
- Resolves: RHEL-106043 - httpd 2.4.62: mod_proxy_connect prematurely closes
connections
* Thu Jul 24 2025 Joe Orton <jorton@redhat.com> - 2.4.63-2
- mod_dav: add dav_get_base_path() API
Resolves: RHEL-105255
* Mon Jan 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-1
- new version 2.4.63
- Resolves: RHEL-76358 - httpd rebase to 2.4.63
- Resolves: RHEL-73414 - RewriteRule proxying to UDS (unix domain socket)
configured in .htaccess doesn't work on httpd-2.4.62-1
- Resolves: RHEL-66489 - Apache HTTPD no longer parse PHP files with unicode
characters in the name
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2.4.62-5
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
/usr/bin/ab /usr/bin/htdbm /usr/bin/htdigest /usr/bin/htpasswd /usr/bin/httxt2dbm /usr/bin/logresolve /usr/lib/.build-id /usr/lib/.build-id/2d /usr/lib/.build-id/2d/2dcff0bcbf6d9089e6b8a83048b90e75b39e45 /usr/lib/.build-id/31/6ccb50929667944e2562db5faad76867723bb1 /usr/lib/.build-id/39/2cdd2874a68430358b9091be5b3063d3a724d2 /usr/lib/.build-id/75 /usr/lib/.build-id/75/568f5a94277bbaf0f37abcb50b21aacaf57fec /usr/lib/.build-id/ea /usr/lib/.build-id/ea/7c03b38c5e763ca42a999258d7d7f4947eeb1c /usr/lib/.build-id/f3 /usr/lib/.build-id/f3/8e9f70ff93ad3af088b1312b825890b842149c /usr/share/doc/httpd-tools /usr/share/doc/httpd-tools/LICENSE /usr/share/doc/httpd-tools/NOTICE /usr/share/man/man1/ab.1.gz /usr/share/man/man1/htdbm.1.gz /usr/share/man/man1/htdigest.1.gz /usr/share/man/man1/htpasswd.1.gz /usr/share/man/man1/httxt2dbm.1.gz /usr/share/man/man1/logresolve.1.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Thu Nov 12 14:30:49 2026