Red Hat Product Errata RHSA-2026:27200 - Security Advisory Issued: 2026-06-22 Updated: 2026-06-22 RHSA-2026:27200 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 3, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section. Security Fix(es): jbcs-httpd24-httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) jbcs-httpd24-httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) jbcs-httpd24-mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) mod_proxy_ajp.so: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) mod_proxy_ajp.so: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) mod_authn_socache.so: NULL pointer dereference can cause a child process crash (CVE-2026-33007) mod_proxy_ajp.so: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) mod_dav_lock.so: NULL pointer dereference via specially crafted request (CVE-2026-29169) jbcs-httpd24-mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) jbcs-httpd24-httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat JBoss Core Services 1 for RHEL 8 x86_64 Red Hat JBoss Core Services 1 for RHEL 7 x86_64 Fixes BZ - 2379343 - CVE-2025-53020 mod_http2: Apache HTTP Server: HTTP/2 DoS by Memory Increase BZ - 2448754 - CVE-2026-27135 nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination BZ - 2464940 - CVE-2026-34059 httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() BZ - 2464952 - CVE-2026-34032 httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check BZ - 2464953 - CVE-2026-33857 httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions BZ - 2465296 - CVE-2026-29169 httpd: NULL pointer dereference via specially crafted request BZ - 2465299 - CVE-2026-33007 httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash BZ - 2466753 - CVE-2026-29168 httpd: mod_md: unrestricted OCSP response leads to resource exhaustion BZ - 2466913 - CVE-2026-28780 Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow BZ - 2485371 - CVE-2026-49975 httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVEs CVE-2025-53020 CVE-2026-27135 CVE-2026-28780 CVE-2026-29168 CVE-2026-29169 CVE-2026-33007 CVE-2026-33857 CVE-2026-34032 CVE-2026-34059 CVE-2026-49975 References https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_4_release_notes/index Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat JBoss Core Services 1 for RHEL 8 SRPM jbcs-httpd24-httpd-2.4.62-13.el8jbcs.src.rpm SHA-256: f881fe06874476101b785e6d01d6413f76278412de7015dfb9ff44dda9921931 jbcs-httpd24-mod_http2-2.0.29-10.el8jbcs.src.rpm SHA-256: 2e0321731f2fd197d25579fe536a16bba415367719e10d1e874ded8a86311452 jbcs-httpd24-mod_jk-1.2.50-14.redhat_1.el8jbcs.src.rpm SHA-256: 675ab8935b724b47723a6c42abe1892f319fae77cdbc4f5774a1e26552a937fa jbcs-httpd24-mod_md-2.4.28-16.el8jbcs.src.rpm SHA-256: 1abe7588abc0482e7385b4fdaca82c6e166ddc9152aaaea1e2949ea63e456942 jbcs-httpd24-mod_proxy_cluster-1.3.22-9.el8jbcs.src.rpm SHA-256: 4c37a67e890fbb5cec7c86df20674052fc5eb8b8e6a85e12c4e89164173f4a1d jbcs-httpd24-mod_security-2.9.6-16.el8jbcs.src.rpm SHA-256: 506c3d82fd296fca7a73f4f2a4a1d522693f6098067c2877f7153ae75d62676d jbcs-httpd24-nghttp2-1.64.0-3.el8jbcs.src.rpm SHA-256: da6a8165b520d0f45f82a0e03f9b6e0c083ebfc3061b920917c242404eead243 x86_64 jbcs-httpd24-httpd-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: ac67d740a74102369709f620110520ad55443aed10d84f52afb97b887cc4f0f9 jbcs-httpd24-httpd-debuginfo-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 767c3857c83b12743789e56e3fe50568cf939b4a0e7dc5dbfec07ff65f661f01 jbcs-httpd24-httpd-devel-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 1574f07b1d2b8440a013c77364132a56d6a7d86ab2f72b1c6b3367e12ef3b672 jbcs-httpd24-httpd-manual-2.4.62-13.el8jbcs.noarch.rpm SHA-256: 680efb9fe0b10b076590903d321cb0c4510edb1c74ed241e3fa017c290f323ce jbcs-httpd24-httpd-selinux-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 457e710a00921c227ae9d5c3e3a496498079c61866419871d03a0bbe15c3af32 jbcs-httpd24-httpd-tools-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 504a36f2960448982e7fb82854be4dd3ec9128f222e86dab23e61deaea4d9239 jbcs-httpd24-httpd-tools-debuginfo-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 2f0245b272be5850934a546e890b55c4528b50f592604ebb355373f28cd95aaf jbcs-httpd24-mod_http2-2.0.29-10.el8jbcs.x86_64.rpm SHA-256: 5b83f6656d06d816d899cc90ea4aee407b92284ecdac1341e2130509dbdb1940 jbcs-httpd24-mod_http2-debuginfo-2.0.29-10.el8jbcs.x86_64.rpm SHA-256: 9fa4c5daa39aa66cae860db080ca0e1fe254f97046f4cddcc889ba7b6ee73813 jbcs-httpd24-mod_jk-ap24-1.2.50-14.redhat_1.el8jbcs.x86_64.rpm SHA-256: 533f434b6e28c63466118a033dd5e7264d023f6b14ef4f35fb927fe29aa5ddda jbcs-httpd24-mod_jk-ap24-debuginfo-1.2.50-14.redhat_1.el8jbcs.x86_64.rpm SHA-256: 46e1d49be2d3179051f9545a70aad8fa5a1ef45e3c23cc6e722d2d6d3853d953 jbcs-httpd24-mod_ldap-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 6eb08c6ba7e530ddd040b8e3303989f8726ef631e9be52fac55cddf984c42fc8 jbcs-httpd24-mod_ldap-debuginfo-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 99e88564a6f1bf3cf257fd1afda4566095ea2015c458d26ce834947b5cc7509e jbcs-httpd24-mod_md-2.4.28-16.el8jbcs.x86_64.rpm SHA-256: 38b7d30c2ff76a1dcf9e6bbfd0306bf3c29453e2a2d3bdd13b5878b22dc239d8 jbcs-httpd24-mod_md-debuginfo-2.4.28-16.el8jbcs.x86_64.rpm SHA-256: c70ee044f0a59b17e6983087dca7da6e3654d416f9fffe26eb55359313845a21 jbcs-httpd24-mod_proxy_cluster-1.3.22-9.el8jbcs.x86_64.rpm SHA-256: a2ecd10279d150f79f30427e8c9b415a606feaddacdd8b5256cc38dfddb36821 jbcs-httpd24-mod_proxy_cluster-debuginfo-1.3.22-9.el8jbcs.x86_64.rpm SHA-256: f24fbb064a574e53a5277731d1c1432a64a0d38335db3a5c45b53b966415ddcf jbcs-httpd24-mod_proxy_html-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 878c4341c9ad0927163eb06a30ab19db00a46094b17781207b79c053f8959097 jbcs-httpd24-mod_proxy_html-debuginfo-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: e0815d9860afb102a7b33a7c74fd2753c882bef91d3cc39085ad968e887fdee4 jbcs-httpd24-mod_security-2.9.6-16.el8jbcs.x86_64.rpm SHA-256: e3449fed2c7a12cecb7a82bc40634ba7f21b6cfa39ccf8f7f52f6374fa30dd88 jbcs-httpd24-mod_security-debuginfo-2.9.6-16.el8jbcs.x86_64.rpm SHA-256: 20fdd93102cb04b3aad73e2c71273405163b8164037a496b3451e41a0c8e88e6 jbcs-httpd24-mod_session-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: a50c4e79664160fb6a1427307cdc4a8871608272a14daa3d2eaf9cfedeeda14d jbcs-httpd24-mod_session-debuginfo-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 89669b7522cbaaa07bd9e31ad709d11ce1f0c3f3c08e51dc2a378b69404e065a jbcs-httpd24-mod_ssl-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 97339794f7a31dfc687d06a4e8f385db2edc619acca116c38a5ff86a34ce2903 jbcs-httpd24-mod_ssl-debuginfo-2.4.62-13.el8jbcs.x86_64.rpm SHA-256: 4d0bbfe0e2308682856830189f2cad7c166046d6924ad76a1a78fd7c3f49fdd2 jbcs-httpd24-nghttp2-1.64.0-3.el8jbcs.x86_64.rpm SHA-256: f84f26fde20fb05ed751fa1b5971f6ea08857b3d92906939015be2bf151d33fd jbcs-httpd24-nghttp2-debuginfo-1.64.0-3.el8jbcs.x86_64.rpm SHA-256: cc349516872966fff2c0918d1cff63e6ef7454a6fd0fca5981808a0575e02425 jbcs-httpd24-nghttp2-devel-1.64.0-3.el8jbcs.x86_64.rpm SHA-256: 27e24345f66bf4c516a7f15e7ab9783539419022f12ad658a91a77cc046b6dc1 Red Hat JBoss Core Services 1 for RHEL 7 SRPM jbcs-httpd24-httpd-2.4.62-13.el7jbcs.src.rpm SHA-256: 7c14b1ccd2ad7fd2c4bb7630d9438e6eb80186668e06a4fdca9a86ac6f1eaef3 jbcs-httpd24-mod_http2-2.0.29-10.el7jbcs.src.rpm SHA-256: 75f66627f58940d4187b9a248eeb00eb6e50438b4daa914acd8484c846b8f8ef jbcs-httpd24-mod_jk-1.2.50-14.redhat_1.el7jbcs.src.rpm SHA-256: 100652916ecf633103b0a2efa92790ef16f2f7525b542de2e4ae49fb48cdd666 jbcs-httpd24-mod_md-2.4.28-16.el7jbcs.src.rpm SHA-256: 77f0a42ce87d247504b72e7e5f4ee01102f7c2c76b02fd27d059dd755e85d