Red Hat Product Errata RHSA-2026:34355 - Security Advisory Issued: 2026-07-01 Updated: 2026-07-01 RHSA-2026:34355 - Security Advisory Overview Updated Packages Synopsis Moderate: mod_http2 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for mod_http2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Bug Fix(es) and Enhancement(s): address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:RHEL-188008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2486405 - CVE-2026-48913 httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. BZ - 2486415 - CVE-2026-43951 httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime CVEs CVE-2026-43951 CVE-2026-48913 References https://access.redhat.com/security/updates/classification/#moderate Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 x86_64 mod_http2-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 8b9f7ab12d4f282cf4cb09ae0ee5ce167d3e6a0c4d7633fd21e5c8d4124bdfba mod_http2-debuginfo-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 9d7b4681b71cc366f36b717a3174b044591e771208a56c9fcbf25c9776146239 mod_http2-debugsource-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 1ba48f1f831be6361ccfc7675db2f56ec2e6f5b2a754f817d428a762bcc3a248 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 x86_64 mod_http2-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 8b9f7ab12d4f282cf4cb09ae0ee5ce167d3e6a0c4d7633fd21e5c8d4124bdfba mod_http2-debuginfo-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 9d7b4681b71cc366f36b717a3174b044591e771208a56c9fcbf25c9776146239 mod_http2-debugsource-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 1ba48f1f831be6361ccfc7675db2f56ec2e6f5b2a754f817d428a762bcc3a248 Red Hat Enterprise Linux for IBM z Systems 10 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 s390x mod_http2-2.0.29-4.el10_2.2.s390x.rpm SHA-256: 8e65748c9a42dda100f52e3cb2372c84cf0f435cfd67113d4404964a6f2a675a mod_http2-debuginfo-2.0.29-4.el10_2.2.s390x.rpm SHA-256: 245dad8b36d85eb2cde1d3f7679ae5d7133f214b1b014ea9e9f59b73eb2dc2be mod_http2-debugsource-2.0.29-4.el10_2.2.s390x.rpm SHA-256: c8db973536e9d3c95601d0e00cdc130f1006c233ac7ac705e7cc1e1fedb94a83 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 s390x mod_http2-2.0.29-4.el10_2.2.s390x.rpm SHA-256: 8e65748c9a42dda100f52e3cb2372c84cf0f435cfd67113d4404964a6f2a675a mod_http2-debuginfo-2.0.29-4.el10_2.2.s390x.rpm SHA-256: 245dad8b36d85eb2cde1d3f7679ae5d7133f214b1b014ea9e9f59b73eb2dc2be mod_http2-debugsource-2.0.29-4.el10_2.2.s390x.rpm SHA-256: c8db973536e9d3c95601d0e00cdc130f1006c233ac7ac705e7cc1e1fedb94a83 Red Hat Enterprise Linux for Power, little endian 10 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 ppc64le mod_http2-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: b84ac4618381a077e50071aa68eaa48ce9a4a48331e87ae733f39510336ad792 mod_http2-debuginfo-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: b1eb449f51c196c07c2ac851b753f618e13dcc77c147bc06358ed5c78a7713da mod_http2-debugsource-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: d6df9e1483b761da482391d084831744271251424053b10a5eec9c212bd5f64b Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 ppc64le mod_http2-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: b84ac4618381a077e50071aa68eaa48ce9a4a48331e87ae733f39510336ad792 mod_http2-debuginfo-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: b1eb449f51c196c07c2ac851b753f618e13dcc77c147bc06358ed5c78a7713da mod_http2-debugsource-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: d6df9e1483b761da482391d084831744271251424053b10a5eec9c212bd5f64b Red Hat Enterprise Linux for ARM 64 10 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 aarch64 mod_http2-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: fa7af6fc714d3a926bdba72c4b5a3f0e4e01e486fb7f8293d4c6338430093043 mod_http2-debuginfo-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: 8c4f4ceccb34b823422ba0779e24fcf55d6a3905e8b57ae66aadeacf1c82520b mod_http2-debugsource-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: 1ef791e59446dda697d0b296a1f01167361f777f6d8451093fe6e7e3b03b496f Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 aarch64 mod_http2-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: fa7af6fc714d3a926bdba72c4b5a3f0e4e01e486fb7f8293d4c6338430093043 mod_http2-debuginfo-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: 8c4f4ceccb34b823422ba0779e24fcf55d6a3905e8b57ae66aadeacf1c82520b mod_http2-debugsource-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: 1ef791e59446dda697d0b296a1f01167361f777f6d8451093fe6e7e3b03b496f Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 aarch64 mod_http2-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: fa7af6fc714d3a926bdba72c4b5a3f0e4e01e486fb7f8293d4c6338430093043 mod_http2-debuginfo-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: 8c4f4ceccb34b823422ba0779e24fcf55d6a3905e8b57ae66aadeacf1c82520b mod_http2-debugsource-2.0.29-4.el10_2.2.aarch64.rpm SHA-256: 1ef791e59446dda697d0b296a1f01167361f777f6d8451093fe6e7e3b03b496f Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 s390x mod_http2-2.0.29-4.el10_2.2.s390x.rpm SHA-256: 8e65748c9a42dda100f52e3cb2372c84cf0f435cfd67113d4404964a6f2a675a mod_http2-debuginfo-2.0.29-4.el10_2.2.s390x.rpm SHA-256: 245dad8b36d85eb2cde1d3f7679ae5d7133f214b1b014ea9e9f59b73eb2dc2be mod_http2-debugsource-2.0.29-4.el10_2.2.s390x.rpm SHA-256: c8db973536e9d3c95601d0e00cdc130f1006c233ac7ac705e7cc1e1fedb94a83 Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 ppc64le mod_http2-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: b84ac4618381a077e50071aa68eaa48ce9a4a48331e87ae733f39510336ad792 mod_http2-debuginfo-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: b1eb449f51c196c07c2ac851b753f618e13dcc77c147bc06358ed5c78a7713da mod_http2-debugsource-2.0.29-4.el10_2.2.ppc64le.rpm SHA-256: d6df9e1483b761da482391d084831744271251424053b10a5eec9c212bd5f64b Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 x86_64 mod_http2-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 8b9f7ab12d4f282cf4cb09ae0ee5ce167d3e6a0c4d7633fd21e5c8d4124bdfba mod_http2-debuginfo-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 9d7b4681b71cc366f36b717a3174b044591e771208a56c9fcbf25c9776146239 mod_http2-debugsource-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 1ba48f1f831be6361ccfc7675db2f56ec2e6f5b2a754f817d428a762bcc3a248 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 SRPM mod_http2-2.0.29-4.el10_2.2.src.rpm SHA-256: 0f48a472bcc324af84cd1aa05c149d6a3e4d4f08d417576b18456b2491521f01 x86_64 mod_http2-2.0.29-4.el10_2.2.x86_64.rpm SHA-256: 8b9f7ab12d4f282cf4cb09ae0