Back to Security Advisories
Httpd Security Update — AlmaLinux 10 (ALSA-2026:34109)
ALSA-2026:34109 updates the Apache HTTP Server (httpd 2.4.63-13.el10_2.4) on AlmaLinux 10, fixing eight CVEs spanning several years of backports: an incomplete-fix follow-up for CVE-2023-38709 (via CVE-2024-42516), a NULL-pointer dereference from crafted requests (CVE-2026-29169), a heap-based buffer overflow, and further request-handling flaws (CVE-2026-34356, CVE-2026-44185, CVE-2026-44631, CVE-2026-42536, CVE-2026-34355). Apache serves every site on the server — update and restart: dnf update httpd*, then systemctl restart httpd.
High
7.3 CVSS
AlmaLinux 10
What this means under a SharedLicense license
Request-handling flaws in Apache itself are reachable by anyone who can reach the web port — NULL dereferences give trivial denial of service, and heap overflow classes in the core server are the worst-case remote code execution surface.
| Architecture | Package | Checksum |
| aarch64 | mod_ldap-2.4.63-13.el10_2.4.aarch64.rpm | 73aaec40ad393d802255b323d05abab817190a50ac21fcec62296a840e5e6828 |
| aarch64 | mod_proxy_html-2.4.63-13.el10_2.4.aarch64.rpm | 7702f911f6289c6fbc63f35020c7e78bb6522a7a98f4b7cb97faee50c446bd6f |
| aarch64 | mod_lua-2.4.63-13.el10_2.4.aarch64.rpm | 8381f2ef25e4c971456954ff1f45f07de4c7ef32a41a023d094057cb31289473 |
| aarch64 | httpd-2.4.63-13.el10_2.4.aarch64.rpm | 839bb7c46cfbda8089d7ab22641550451fd0eb8aa183b79356a9b70e5af4ecc2 |
| aarch64 | mod_session-2.4.63-13.el10_2.4.aarch64.rpm | 913f32f9dc2d86123cd4427cf374b223c29abdeac3243a70e7100bfba1b8c77f |
| aarch64 | httpd-core-2.4.63-13.el10_2.4.aarch64.rpm | ad1d95f599958df7e6fbe328beba9855f38f7a511cb7e5816b2a9598e33ffff2 |
| aarch64 | httpd-devel-2.4.63-13.el10_2.4.aarch64.rpm | b6b95b4bf34c82fb63af257254951b965174664d33a4784e30d32a988fcfab36 |
| aarch64 | httpd-tools-2.4.63-13.el10_2.4.aarch64.rpm | eb1c741cfb635dde4d65dce20fd6721629add3b703430bc56377825aadded105 |
| aarch64 | mod_ssl-2.4.63-13.el10_2.4.aarch64.rpm | ec4384668cdc722448a6e8e9d48396a36c0ddea87b65a145ccffa73a3a659323 |
| noarch | httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm | 30a9431c19d9b0eaee77dd0b3a9c83a8c8a3a28bd86f1779bae9f85de7bc9f30 |
| noarch | httpd-manual-2.4.63-13.el10_2.4.noarch.rpm | 5e32be7a095c8c1c4519272d18d660a3422b7a943ac850a731cff5f11027152d |
| ppc64le | mod_lua-2.4.63-13.el10_2.4.ppc64le.rpm | 5f0ce47837056b673082124f65459c8169486c0d27f21fe1de44389977fca781 |
| ppc64le | mod_ssl-2.4.63-13.el10_2.4.ppc64le.rpm | 6c38fb0284a2186191d1b22ebc80b363caf9f4f11700bd8cc67da1dabf03d2fe |
| ppc64le | mod_proxy_html-2.4.63-13.el10_2.4.ppc64le.rpm | 7bad418f1466820268c14360b056b95d1c8122b1ac45c2be80123ac3069a4cf8 |
| ppc64le | mod_session-2.4.63-13.el10_2.4.ppc64le.rpm | 9edbc8752da22adc9145420d106d00f744c54e7231ce627dadfa9e30459e9d20 |
| ppc64le | httpd-core-2.4.63-13.el10_2.4.ppc64le.rpm | a449a28eb84a81a4303afa4aae8f780c05b05c2b94df3ab065160c1ddd21f50a |
| ppc64le | httpd-tools-2.4.63-13.el10_2.4.ppc64le.rpm | c43711ca4d87585f3755fab2db5fb2011dc981e0830f1da99d0469f6a1c7be37 |
| ppc64le | httpd-2.4.63-13.el10_2.4.ppc64le.rpm | de990119d44ae193a78cdf346d554ec54817534795d6342f95414df66a912a84 |
| ppc64le | httpd-devel-2.4.63-13.el10_2.4.ppc64le.rpm | e9f8f0170a45e2a0963bec707d6dfd45ddaa9e2dffbbf8465cdddaf089b3f8cb |
| ppc64le | mod_ldap-2.4.63-13.el10_2.4.ppc64le.rpm | eb614d1b7a7fc7519de9edad8a228f8e89b8fc81777f6ccfeb0ea59ce64dae8e |
| s390x | mod_session-2.4.63-13.el10_2.4.s390x.rpm | 1ea2283dc07624ccd46bb26c063903060d9ed4165f26b21ed16d8d177e4aa4c8 |
| s390x | httpd-tools-2.4.63-13.el10_2.4.s390x.rpm | 223887e17e6950c6eddf981f206a6d2053829c173f564a30f827f25cd0dc48c9 |
| s390x | mod_ldap-2.4.63-13.el10_2.4.s390x.rpm | 3d8193b862177d63b16dea066472f6cb7fc551ad7fdcfd37db53fbdc69a1cb5e |
| s390x | mod_lua-2.4.63-13.el10_2.4.s390x.rpm | 40bb160b7bb00166da9fbec14af7335d62ad348db1254ee5d73b7d7fe7db6399 |
| s390x | httpd-2.4.63-13.el10_2.4.s390x.rpm | 5f0593ed0bcd8da3593680807c90f2bac7a40661f2d3a247f0f485095bbb9e96 |
| s390x | httpd-devel-2.4.63-13.el10_2.4.s390x.rpm | 746ee8715a133ec69257d7f0fe41fae8147a0382966334d12b6d57536b1fa150 |
| s390x | mod_ssl-2.4.63-13.el10_2.4.s390x.rpm | 8c4233a6eeda0bb9aa9e45c39a51507ca80d3a65a83b85d9e4527999bb5a1bc5 |
| s390x | httpd-core-2.4.63-13.el10_2.4.s390x.rpm | a949a52d5f0e1adaf425614c691ede07eac85ccc0b4b09d404a7e5478417248a |
| s390x | mod_proxy_html-2.4.63-13.el10_2.4.s390x.rpm | b8c6a80235c1612a21a95d1d6e83b6537917effe2369ff84eb2c445a3c383efa |
| x86_64 | mod_lua-2.4.63-13.el10_2.4.x86_64.rpm | 04b1ec7b2b14f5e619c6515530a502710dc9d17b2843b2bda588d4b941ce80d6 |
| x86_64 | mod_session-2.4.63-13.el10_2.4.x86_64.rpm | 6e983fb5b3c48eae5eb9806891adc8bd01399007367f6879dd4250bcd613f62a |
| x86_64 | httpd-core-2.4.63-13.el10_2.4.x86_64.rpm | 6fe618c10f1539f09ad9a3dcd28c6ba2792c89388c8b79d5e4cc4c1263c5a592 |
| x86_64 | mod_ssl-2.4.63-13.el10_2.4.x86_64.rpm | 7e904209f76be48f00d7cf3f2e1da484a7e83219d43c1b0cfcc346b18a330234 |
| x86_64 | httpd-tools-2.4.63-13.el10_2.4.x86_64.rpm | 8e47adecd11354def1ac92f87a7bea0b31607a42aa0e3389b0b8c5f9e1d8fc0e |
| x86_64 | mod_ldap-2.4.63-13.el10_2.4.x86_64.rpm | 956c298478071fc565d7b4fedf42469e7db3f46e58f4e6375a45c2178eb38347 |
| x86_64 | httpd-devel-2.4.63-13.el10_2.4.x86_64.rpm | cc8067bd0949526415899788ddab5a4c8a9e9fdd20738e1ac595e6f7f735cf5f |
| x86_64 | httpd-2.4.63-13.el10_2.4.x86_64.rpm | f072b01be5ef050a8d280d9a86ff2087d7d63481efd6acc35ac0d245c910d944 |
| x86_64 | mod_proxy_html-2.4.63-13.el10_2.4.x86_64.rpm | f8ba3696c5bcbac939b042557b5307cc356399709f55c000ee17fe5ba1bebab6 |
| x86_64_v2 | httpd-2.4.63-13.el10_2.4.x86_64_v2.rpm | 0c8068e1fa62e7652c059228ec35a1bc83c6543d7a7a0c89bb29a05edc0fb18d |
| x86_64_v2 | httpd-devel-2.4.63-13.el10_2.4.x86_64_v2.rpm | 3bdd366b7547e822654bd67cf36c0a8f7c4ae92486a46e3d015cc76e3fd3af88 |
| x86_64_v2 | mod_ssl-2.4.63-13.el10_2.4.x86_64_v2.rpm | 4f38e6a427108fce27fb47d7b7d68aa07ea72f9c38b150e3d27a4390af3a2b67 |
| x86_64_v2 | mod_ldap-2.4.63-13.el10_2.4.x86_64_v2.rpm | 8c589f88ee7ab86e438b4de2c2c31f6c13d9a93127549fa1944ba49390883b3c |
| x86_64_v2 | httpd-core-2.4.63-13.el10_2.4.x86_64_v2.rpm | b1cf3d4dd0357a486e67b7ae7f4dd7562e5ae555000f02e591e22476e89db7d1 |
| x86_64_v2 | mod_lua-2.4.63-13.el10_2.4.x86_64_v2.rpm | e4d8fe3d5d17e449235fc20b7809e2d3e9aad91ffd85edb600343be47b3252cd |
| x86_64_v2 | httpd-tools-2.4.63-13.el10_2.4.x86_64_v2.rpm | ea1d92826f861f6341fe6a2995f6e448bebf8b82a57e18fa36b31eac716b30af |
| x86_64_v2 | mod_session-2.4.63-13.el10_2.4.x86_64_v2.rpm | f8f5e0c9ec3d3529ca6fe0cc1989239cf6a5df5bd2ac0699f9a90331ddb62717 |
| x86_64_v2 | mod_proxy_html-2.4.63-13.el10_2.4.x86_64_v2.rpm | fbccc71139e64fd2db3a5ca01e784671494816549e69f17b0cedc7d8da685857 |
Frequently Asked Questions
What does ALSA-2026:34109 fix?
Eight Apache HTTP Server CVEs in httpd 2.4.63-13.el10_2.4: CVE-2023-38709 (via its incomplete-fix follow-up CVE-2024-42516), CVE-2026-29169 (NULL pointer dereference via crafted request), CVE-2026-34356, CVE-2026-44185, CVE-2026-44631, CVE-2026-42536 and CVE-2026-34355 — including a heap-based buffer overflow class fix.
Which Apache versions are affected?
AlmaLinux 10 httpd builds before 2.4.63-13.el10_2.4. The erratum covers httpd-core plus the module packages (mod_ldap, mod_proxy_html, mod_lua, mod_session), so a single update refreshes the full server and module set.
How do I apply the fix?
Run dnf update httpd* and restart Apache (systemctl restart httpd). Verify with httpd -v that the running build reports 2.4.63-13.el10_2.4 or later — configuration is preserved across the package update.
Is the 2023-year CVE in this list still relevant?
Yes — CVE-2024-42516 is an incomplete-fix follow-up to CVE-2023-38709, meaning the original patch did not fully close the flaw. The 2026 erratum ships the complete fix, which is why older backported CVEs appear in current release notes.
References
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System