The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_88229 advisory.

    * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi     (CVE-2026-63718)

    * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546)

    * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests     (CVE-2026-73637)

    * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)

    * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292)

    * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729)

    * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636)

    * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686)

    * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005)

    * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154)

    * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88229)

critical Nessus Plugin ID 371689

Version 1.2

Version 1.1

Version 1.2 Nov 2, 2026, 8:29 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202611020829
Version 1.1 Oct 24, 2026, 4:50 PM New Plugin Feed: 202610241650