Red Hat Product Errata RHSA-2026:0009 - Security Advisory
Issued:
2026-01-05
Updated:
2026-01-05

RHSA-2026:0009 - Security Advisory

Synopsis

Important: httpd:2.4 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  • httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 8.2 x86_64

Fixes

  • BZ - 2419140 - CVE-2025-55753 mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals
  • BZ - 2419365 - CVE-2025-58098 httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

Red Hat Enterprise Linux Server - AUS 8.2

SRPM
httpd-2.4.37-21.module+el8.2.0+23841+60fa4803.11.src.rpm SHA-256: 80e248e503a6e5ff39306f71ca22204061866c837002f497d338bd71eba68561
mod_http2-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.src.rpm SHA-256: 72d75b3cc4206ecafc3caefccf2f9322cdec289ec516bd97cd77d25c5ba4f858
mod_md-2.0.8-7.module+el8.2.0+23841+60fa4803.1.src.rpm SHA-256: 2ee889c237bbe7c1adc6914daf11a990b342677e257da7aa332c3dd816ded98c
x86_64
httpd-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: cf54efa7aabf231308f2f3468a3f71bd72ce7c3382fc15c7cb22b47915911af6
httpd-debuginfo-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: e6d76606a5689086aa87cc14651311bbeec7be466d9b21b647297c9d403b666f
httpd-debugsource-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 35642ab432a59052d6e83a27385ba731fbdc48f3da63dfe74292aafe52668496
httpd-devel-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 1f12ea1df0e4061523fca9e4e63b459ff416c58ac7a97205f18edb7011f3830d
httpd-filesystem-2.4.37-21.module+el8.2.0+23841+60fa4803.11.noarch.rpm SHA-256: d79a8eca216947f1419eeb0efb4410eb19d6ccf6ae1e0eea98264aabe7b45b06
httpd-manual-2.4.37-21.module+el8.2.0+23841+60fa4803.11.noarch.rpm SHA-256: 78b8b00441adbd20bfa9f6eb5d73885a14364e7115cc48d699dc4c72efae39a2
httpd-tools-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 7cf5ed4577bda4990a524af603382c479240172781457cdb74b3d8ebaeb580e4
httpd-tools-debuginfo-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 3a0524c01ea46869c31eeca302cb2903652f91ee2189edeb5ae0ff6c32146293
mod_http2-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.x86_64.rpm SHA-256: b53407b18527f3257e2b62e1050ca45c9dfb3c8f7fb97a3e4261499cebcc431e
mod_http2-debuginfo-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.x86_64.rpm SHA-256: 320579fa50dd6d13d9d3880a9ca1b94cb0ca0a75d48ed09af04cc27ba0f8b363
mod_http2-debugsource-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.x86_64.rpm SHA-256: 28498e7a918a80dea50cd26973f8f5af2649e0f1a309ea3b386d7bc394f4380a
mod_ldap-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 0ebc33d89929de9295177c7ab89a2cfdb9d0377e226eebf392485848a4acf0f5
mod_ldap-debuginfo-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 3a643e9caef651d3ba5bd90ca48f845f8ee5ef151d52a95e50d711e2e4ebe072
mod_md-2.0.8-7.module+el8.2.0+23841+60fa4803.1.x86_64.rpm SHA-256: 3d4ee1f6befba8eb101968c80b78c909c081564b333a6390be6742fcf4342606
mod_md-debuginfo-2.0.8-7.module+el8.2.0+23841+60fa4803.1.x86_64.rpm SHA-256: 296a52552af28067c11522ef6904515175e22440202d4c98af18cf860ed46507
mod_md-debugsource-2.0.8-7.module+el8.2.0+23841+60fa4803.1.x86_64.rpm SHA-256: 17209cb4594b859e069cb5c4867aaacfdf763690d62133be74a6414324ccdd84
mod_proxy_html-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 521c6a0b47335b47aa467617a5231b1e48e87e88e2994c13e973ee2c3fb453e4
mod_proxy_html-debuginfo-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 7748241eeb4b03ae77cb640ddfb5d29e99b41698b6b57ef2ff68ed8e2b7ad367
mod_session-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: ec9d28cf11262125af33d40fd679f8b45839428a50c4789a3e1a5c0977c50e4f
mod_session-debuginfo-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 4a74b11d8c0da72544a28fba75f29f2674fefb8c84fb12a17c537861f35d5573
mod_ssl-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: 3859a9f8957c291b0ad0afdde83b68fe17594d06665a92771a117b6269f089c4
mod_ssl-debuginfo-2.4.37-21.module+el8.2.0+23841+60fa4803.11.x86_64.rpm SHA-256: d21b5f53f60846d209b57779d59851b732b4c7a3c2343deeda4473212a979fc8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.