The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791889844 advisory.

  - A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission     to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version     2.4.69, which fixes this issue (CVE-2026-42528)

  - Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before     2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-     authentication) via forged Authorization headers when Digest authentication is enabled with     AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.
    (CVE-2026-48005)

  - Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache     HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of     resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP     Server: from 2.4.0 through 2.4.68. (CVE-2026-58415)

  - Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-     related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. (CVE-2026-59797)

  - Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP     Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to     cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
    Users are recommended to upgrade to version 2.4.69, which fixes this issue. (CVE-2026-63045)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791889844)

critical Nessus Plugin ID 368028

Version 1.2