The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:34109 advisory.

    * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
      * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
      * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
      * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server     (CVE-2026-44185)
      * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
      * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc     (CVE-2026-42536)
      * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)


    Bug Fix(es) and Enhancement(s):

      * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92590 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

    * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()     (CVE-2026-34059)

    * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)

    * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)

    * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

    * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)

    * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-     based buffer overflow (CVE-2026-28780)

    * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap     per-directory configuration (CVE-2026-29167)

    * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server     (CVE-2026-44185)

    * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server     (CVE-2026-44186)

    * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc     (CVE-2026-42536)

    * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41906 advisory.

    * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)
      * Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file     manipulation (CVE-2026-24072)
      * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)
      * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)
      * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)
      * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server     (CVE-2026-44185)
      * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)
      * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server     (CVE-2026-44186)
      * httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535)
      * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc     (CVE-2026-42536)
      * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)
      * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)
      * httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges     (CVE-2026-44119)


    Bug Fix(es) and Enhancement(s):

      * address Moderate severity issues from httpd 2.4.68 [almalinux-9.8.z] (JIRA:AlmaLinux-184520)
      * mod_proxy_html regression in CVE-2026-34355 fix [almalinux-9.8.z] (JIRA:AlmaLinux-192752)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_41906 advisory.

    * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

    * Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file     manipulation (CVE-2026-24072)

    * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006)

    * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

    * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

    * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server     (CVE-2026-44185)

    * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

    * httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server     (CVE-2026-44186)

    * httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue (CVE-2026-42535)

    * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc     (CVE-2026-42536)

    * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

    * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

    * httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges     (CVE-2026-44119)

    Bug Fix(es) and Enhancement(s):

    * address Moderate severity issues from httpd 2.4.68 [rhel-9.8.z] (JIRA:Rocky Linux-184520)

    * mod_proxy_html regression in CVE-2026-34355 fix [rhel-9.8.z] (JIRA:Rocky Linux-192752)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

The remote host is affected by the vulnerability described in GLSA-202608-05 (Apache HTTPD: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
324590	AlmaLinux 10 : httpd (ALSA-2026:34109)	Nessus	Alma Linux Local Security Checks	2026/7/1	2026/9/16	critical
373957	RHEL 7 : httpd (RHSA-2026:92590)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/10/30	critical
328786	AlmaLinux 9 : httpd (ALSA-2026:41906)	Nessus	Alma Linux Local Security Checks	2026/7/21	2026/7/21	critical
358908	Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_41906)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
332443	Photon OS 5.0: Httpd PHSA-2025-5.0-91-0570	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/4	critical
335265	GLSA-202608-05 : Apache HTTPD: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2026/8/13	2026/8/17	high

检测

插件搜索

critical

critical

critical

critical

critical

high