Apache Vulnerabilities

genisis__ — Fri, 08 May 2026 10:27:37 GMT

Hi.

Do Checkpoint have a response to the below Redhat CVEs yet?

CVE-2026-23918

Re: Apache Vulnerabilities

PhoneBoy — Fri, 08 May 2026 20:41:31 GMT

Most of these CVEs are for modules/functions we don't use in our implementation, as near as I can tell.
Having said that, if you're looking for an official answer, that'll require a TAC case.

Re: Apache Vulnerabilities

genisis__ — Mon, 18 May 2026 11:30:23 GMT

Thanks..I will raise a TAC case, for a formal response.

TAC have come back with the below:

CVE-2026-23918 - Not vulnerable. The vulnerability affects only Apache HTTP Server 2.4.66; the product ships with version 2.4.61, which is not in the affected range.
CVE-2026-29168 - Not vulnerable. mod_md is not shipped with our images.
CVE-2026-24072 - Not exploitable. The product does not allow non-administrative users to author .htaccess files. Only the root/admin user has write access to the web tree, so there is no privilege boundary for the bug to cross. Additionally, AllowOverride None is configured, so .htaccess files would be ignored even if planted.
CVE-2026-29169 - Not exploitable. mod_dav_lock is loaded as a default module but is not configured: no Dav directives and no DavGenericLockDB exist in the Apache configuration.
CVE-2026-33006 - Not exploitable. The product does not use HTTP Digest authentication.
CVE-2026-33007 - Not exploitable. The product is not configured as a forward proxy. The vulnerable code path requires a caching forward proxy configuration.
CVE-2026-33523 - Not exploitable. The product does not relay HTTP responses from untrusted or third-party backend servers.
CVE-2026-28780 - Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.
CVE-2026-33857- Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.
CVE-2026-34032- Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.
CVE-2026-34059 - Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.

Additionally below will be updated as well soon:
sk182900 - Check Point response to Apache HTTP Server CVEs

topic Re: Apache Vulnerabilities in General Topics

Apache Vulnerabilities

Re: Apache Vulnerabilities

Re: Apache Vulnerabilities