The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791471297 advisory.

  - NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This     issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. (CVE-2026-46729)

  - Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP     Server: from 2.4.0 through 2.4.68. (CVE-2026-56153)

  - Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...})     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. (CVE-2026-56154)

  - Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response     bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. (CVE-2026-56449)

  - Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through     2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute     arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a     hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to     upgrade to version 2.4.69, which fixes this issue. (CVE-2026-63292)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791471297)

critical Nessus Plugin ID 365092

Version 1.2

Version 1.1

Version 1.2 Oct 16, 2026, 7:34 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202610161934
Version 1.1 Oct 13, 2026, 2:52 AM New Plugin Feed: 202610130252