Good morning,

we got an security alert for Apache httpd 2.4.67 with this CVE:
CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356, CVE-2026-42535,
CVE-2026-42536, CVE-2026-43951, CVE-2026-44119, CVE-2026-44185, CVE-2026-44186,
CVE-2026-44631, CVE-2026-48913, CVE-2026-49975

Base Score: 9.8

https://downloads.apache.org/httpd/CHANGES_2.4.68

Can we awaid new packages für version 2.4.68?

We will be updating soon in AIX Toolbox. 

httpd 2.4.68 is now available in AIX Toolbox. 

good morning,

thank you for yor work.

Stefan

Hi,

When applying this update,  do any running instances need to be stopped and/or restarted ? Also, how do we check that the update actually includes the fixes.

Richard

Hi @Richard Mochnacewski

Running httpd instances typically need to be restarted after the updated binaries are installed. Existing worker processes continue to run the old code until the service is restarted.

The fixes usually do not take effect until the server is restarted from what I know.

> Also, how do we check that the update actually includes the fixes.

To verify that the update was installed, check the version in your LPAR:

• httpd -v

• apachectl -v

Additionally, in AIX, if you want to check which version has the fix, then run the below command and check the latest change log. 

rpm -q --changelog httpd

------------------------------
Aditya Kamath
------------------------------