Red Hat Product Errata RHSA-2026:73076 - Security Advisory
Issued:
2026-09-29
Updated:
2026-09-29

RHSA-2026:73076 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 is now available.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 5, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.

Security Fix(es):

  • jbcs-httpd24-httpd: HTTP response splitting forwarding malicious status line (CVE-2026-33523)
  • mod_auth_digest.so: timing attack allows a bypass of digest authentication (CVE-2026-33006)

A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat JBoss Core Services 1 for RHEL 8 x86_64

Fixes

  • BZ - 2465293 - CVE-2026-33006 httpd: mod_auth_digest: timing attack allows a bypass of digest authentication
  • BZ - 2465297 - CVE-2026-33523 httpd: HTTP response splitting forwarding malicious status line

Red Hat JBoss Core Services 1 for RHEL 8

SRPM
jbcs-httpd24-httpd-2.4.62-17.el8jbcs.src.rpm SHA-256: f5a7a0ee94ebcdcb4f9d3a84a0be8730c83f36bd00dfc9719e1774b8eae5cfee
jbcs-httpd24-mod_http2-2.0.29-14.el8jbcs.src.rpm SHA-256: 042c92ad33ff826aeb749fb9d21fe823218b57dea4f402715f1da8d1788a260c
jbcs-httpd24-mod_jk-1.2.50-18.redhat_1.el8jbcs.src.rpm SHA-256: 02812b1b4e364b43a50e9b0cb70a512eb27b6e4d1c1daeb2b0c18d91d2f8f4aa
jbcs-httpd24-mod_md-2.4.28-20.el8jbcs.src.rpm SHA-256: c65aac62b616ce1e366e812af4f98de45e24efd4af5d5c20a41814f7dc8d5091
jbcs-httpd24-mod_proxy_cluster-1.3.22-13.el8jbcs.src.rpm SHA-256: 60aade8b0ef656ee5f95e4e3d474f9b063a4d084d66391358553fd1587bf7575
jbcs-httpd24-mod_security-2.9.6-20.el8jbcs.src.rpm SHA-256: ae4d1bc57b92023a223c4732262fa7969618a10c3ccfb271c9bb49133d987fd9
x86_64
jbcs-httpd24-httpd-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: ded815ac91eb9b1088061469a70964ea65cd93d6dbea01b6c4ce24490f1fe173
jbcs-httpd24-httpd-debuginfo-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 106eb59748070c89fb3ec925f598089d8d30594d7979405ceec539ab3397c86e
jbcs-httpd24-httpd-devel-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 5cc28930fac771ae39dd797e80a20a30d666cdb336e2aacb6994cf5d9ecc2471
jbcs-httpd24-httpd-manual-2.4.62-17.el8jbcs.noarch.rpm SHA-256: e9b6903586d6d580a1846f26ca1994024d66b8d0e38ad750bfcfb1b63a6b97af
jbcs-httpd24-httpd-selinux-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 64c906afc48fc94674cd04608189a34791528501f1b2208524e4b5f3107b19f8
jbcs-httpd24-httpd-tools-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: ea4cbac6428b3ae2a23615925475ddd6f05fefd3c0fb8c659d5964694854265b
jbcs-httpd24-httpd-tools-debuginfo-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 988b008bef7355bce08d927184a434ae0e11262698c5226c4c75dce4ad721842
jbcs-httpd24-mod_http2-2.0.29-14.el8jbcs.x86_64.rpm SHA-256: 45d849ddc7665f5c6728964069c0c3665c29f775d7f1255e599af1ab66322a6c
jbcs-httpd24-mod_http2-debuginfo-2.0.29-14.el8jbcs.x86_64.rpm SHA-256: a58cb272ae1ecc0b099c45cdc62106aa4eba2ca61b6cb99933965c6ae10c00af
jbcs-httpd24-mod_jk-ap24-1.2.50-18.redhat_1.el8jbcs.x86_64.rpm SHA-256: dbd6bab34e2c23feb13301276cc4fb2dc67b66716aebb1fad1cb3f7a02f091fc
jbcs-httpd24-mod_jk-ap24-debuginfo-1.2.50-18.redhat_1.el8jbcs.x86_64.rpm SHA-256: 3f38a38e2b0d334692eab8e5e564a283a0c79b0cc2cba7b033609520d350afeb
jbcs-httpd24-mod_ldap-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 7574342ad78b3f6dd9ff8505a46550611e075765f0bd4825436cdcef68aabfb0
jbcs-httpd24-mod_ldap-debuginfo-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: dfbc418dd59297083b9a54f135d1637d163d3e4b60689285c21452156ac131ef
jbcs-httpd24-mod_md-2.4.28-20.el8jbcs.x86_64.rpm SHA-256: 7377dfd5eb1b9be50e5f82a9955b1c2b914812a1b6c7b05dbc47299921600493
jbcs-httpd24-mod_md-debuginfo-2.4.28-20.el8jbcs.x86_64.rpm SHA-256: e76c9f7ae4fb23ed800ebf1a35d7caff3dd299903e5463bde1b6baa45627c71f
jbcs-httpd24-mod_proxy_cluster-1.3.22-13.el8jbcs.x86_64.rpm SHA-256: 56ac7e9cba076a94a91863f7249683489ace0a806fcae881e36dd5e14fbf2b1e
jbcs-httpd24-mod_proxy_cluster-debuginfo-1.3.22-13.el8jbcs.x86_64.rpm SHA-256: 313ad621d8ba9c501e40037e79c360d0f67e490e4c0f070b1a3a3d45bbb6aa1e
jbcs-httpd24-mod_proxy_html-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: de785aa29cfc962ad25fe304c4aed962bdc4e7a15fa84f47e206dcbce38a2ef0
jbcs-httpd24-mod_proxy_html-debuginfo-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 1101bc6ff93a67f79828a19856c16b2292ac782328abfd5ce1eb5a01b1fd2d5c
jbcs-httpd24-mod_security-2.9.6-20.el8jbcs.x86_64.rpm SHA-256: b5748191e22bc2bd99d419d5c9c265a209b536903b44adfd18757307dd0d2095
jbcs-httpd24-mod_security-debuginfo-2.9.6-20.el8jbcs.x86_64.rpm SHA-256: b5fdc0dc3841fcce56f70adf10cadfa912185eb628684a7484451026784a0946
jbcs-httpd24-mod_session-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: ed09c03110a0930a08105e7b83eff51291217018c0b007f601a52a706aced4a2
jbcs-httpd24-mod_session-debuginfo-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: ae5ac6a5cd33b1bb01f08ca51e884c164f7a00c4ebe52561df051005287eeafd
jbcs-httpd24-mod_ssl-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 9563d46da464a1a08ab64eebd3ddbc5937d293e05cac4b67b3c8e1971172cf1b
jbcs-httpd24-mod_ssl-debuginfo-2.4.62-17.el8jbcs.x86_64.rpm SHA-256: 2de83a81bf3ec0e75ac5c1d663b2708dea67e18dac860fedbde21209a7907f85

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.