The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3121 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122)

    * mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0664 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-31122:
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57.

    CVE-2023-45802:
    When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory     resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A     client could send new requests and resets, keeping the connection busy and open and causing the memory     footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run     out of memory before that.

    This was found by the reporter during testing ofCVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their     own test client. During normal HTTP/2 use, the probability to hit this bug is very low. The kept memory     would not become noticeable before the connection closes or times out.

    Users are recommended to upgrade to version 2.4.58, which fixes the issue.

    CVE-2023-43622:
    An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of     that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the     server, similar to the well known slow loris attack pattern.
    This has been fixed in version 2.4.58, so that such connection are terminated properly after the     configured connection timeout.

    This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.

    Users are recommended to upgrade to version 2.4.58, which fixes the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd24 installed on the remote host is prior to 2.4.58-1.101. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1877 advisory.

    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

    A flaw was found in httpd. This flaw allows an attacker opening an HTTP/2 connection with an initial     window size of 0 to block handling of that connection indefinitely in the Apache HTTP Server. This     vulnerability can exhaust worker resources in the server, similar to the well-known slow loris attack     pattern. (CVE-2023-43622)

    DescriptionA flaw was found in mod_http2. When a HTTP/2 stream is reset (RST frame) by a client, there is     a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation     was deferred to connection close. A client could send new requests and resets, keeping the connection busy     and open, causing the memory footprint to keep on growing. On connection close, all resources are     reclaimed but the process might run out of memory before connection close.

    StatementDuring normal HTTP/2 use, the probability of encountering this issue is very low. The kept     memory would not become noticeable before the connection closes or times out.

    MitigationMitigation for this issue is either not available or the currently available options don't meet     the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread     installation base or stability. (CVE-2023-45802)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-7933:02 advisory.

    * httpd: mod_http2: DoS in HTTP/2 with initial window size 0 (CVE-2023-43622)
      * mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2686-1 advisory.

    This update for apache2 fixes the following issues

    - CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
    - CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
    - CVE-2026-28780: heap buffer overflow in `mod_proxy_ajp` via `ajp_msg_check_header()` (bsc#1264163).
    - CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
    - CVE-2026-29168: allocation of resources without limits in `mod_md` via OCSP response (bsc#1264150).
    - CVE-2026-29169: NULL pointer dereference in `mod_dav_lock` allows server crash via malicious requests     (bsc#1263956).
    - CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
    - CVE-2026-33006: `mod_auth_digest` timing attack allows bypass of Digest authentication (bsc#1263955).
    - CVE-2026-33007: NULL pointer dereference in `mod_authn_socache` allows unauthenticated remote user to     crash a child       processes (bsc#1263954).
    - CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
    - CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
    - CVE-2026-34032: heap buffer overread in `mod_proxy_ajp` due to missing null-termination check     (bsc#1263951).
    - CVE-2026-34059: heap buffer overread and memory disclosure via `ajp_parse_data()` (bsc#1263950).
    - CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
    - CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
    - CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
    - CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
    - CVE-2026-43951: out-of-bound read in `merge_response_headers` can cause crash (bsc#1267963).
    - CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
    - CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (bsc#1267969).
    - CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a     denial of       service (bsc#1267970).
    - CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
    - CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-     free       (bsc#1267972).
    - CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

    Non security issue:

    - Update to 2.4.66 (jsc#PED-16334).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8338-1 advisory.

    It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could     possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04     LTS. (CVE-2023-38709)

    Will Dormann and David Warren discovered that Apache HTTP Server's HTTP/2 implementation did not properly     reclaim memory when streams were reset by clients. A remote attacker could possibly use this issue to     cause Apache HTTP Server to consume resources, leading to a denial of service. This issue only affected     Ubuntu 18.04 LTS. (CVE-2023-45802)

    Keran Mu and Jianjun Chen discovered that Apache HTTP Server incorrectly handled certain response headers.
    An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only     affected Ubuntu 14.04 LTS. (CVE-2024-24795)

    Orange Tsai discovered that Apache HTTP Server mod_proxy incorrectly handled URL encoding. A remote     attacker could possibly use this issue to bypass authentication via crafted requests. This issue only     affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-38473)

    Orange Tsai discovered that Apache HTTP Server could be caused to perform server-side request forgery     (SSRF) via malicious backend response headers. A remote attacker could possibly use this issue to conduct     SSRF attacks or disclose sensitive information. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2024-38476)

    Orange Tsai discovered that Apache HTTP Server mod_proxy did not properly handle certain null pointer     conditions. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38477)

    Orange Tsai discovered that Apache HTTP Server mod_rewrite could be made to perform server-side request     forgery (SSRF) via unsafe RewriteRules. A remote attacker could possibly use this issue to conduct SSRF     attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-39573)

    It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could     possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04     LTS. (CVE-2024-42516)

    It was discovered that Apache HTTP Server could be caused to perform server-side request forgery (SSRF)     via mod_headers modifying Content-Type headers. A remote attacker could possibly use this issue to conduct     SSRF attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-43204)

    John Runyon discovered that Apache HTTP Server mod_ssl did not properly escape user-supplied data before     writing log entries. A remote attacker could possibly use this issue to insert escape sequences into log     files. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-47252)

    Robert Merget discovered that Apache HTTP Server with SSLEngine optional was vulnerable to HTTP     desynchronisation attacks. An attacker in a privileged network position could possibly use this issue to     hijack HTTP sessions. This issue only affected Ubuntu 14.04 LTS. (CVE-2025-49812)

    It was discovered that Apache HTTP Server mod_md had an integer overflow in the ACME certificate renewal     backoff timer. An attacker could possibly use this issue to cause excessive certificate renewal requests.
    This issue only affected Ubuntu 20.04 LTS. (CVE-2025-55753)

    Anthony Parfenov discovered that Apache HTTP Server with SSI enabled and mod_cgid passed shell-escaped     query strings to #exec cmd directives. A remote attacker could possibly use this issue to perform command     injection. (CVE-2025-58098)

    Mattias sander discovered that Apache HTTP Server incorrectly gave precedence to environment variables     from HTTP headers over server-calculated CGI variables. A remote attacker could possibly use this issue to     influence the environment of CGI programs. (CVE-2025-65082)

    Mattias sander discovered that Apache HTTP Server mod_userdir with suexec could be caused to run CGI     scripts under an unexpected user ID via RequestHeader directives in .htaccess files. An attacker with     .htaccess write access could possibly use this issue to bypass suexec user restrictions. (CVE-2025-66200)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
197755	RHEL 8 : httpd:2.4 (RHSA-2024:3121)	Nessus	Red Hat Local Security Checks	5/23/2024	4/29/2025	high
239861	TencentOS Server 4: httpd (TSSA-2024:0664)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
184389	Amazon Linux AMI : httpd24 (ALAS-2023-1877)	Nessus	Amazon Linux Local Security Checks	11/3/2023	12/11/2024	high
292942	MiracleLinux 9 : mod_http2-2.0.26-1.el9 (AXSA:2024-7933:02)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
324047	SUSE SLES15: apache2 / apache2-devel / apache2-doc / apache2-prefork / etc (SUSE-SU-2026:2686-1)	Nessus	SuSE Local Security Checks	7/1/2026	7/1/2026	high
320481	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Apache HTTP Server vulnerabilities (USN-8338-1)	Nessus	Ubuntu Local Security Checks	6/11/2026	6/11/2026	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical