Apache Vulnerabilities

[genisis__]

Hi.

Do Checkpoint have a response to the below Redhat CVEs yet?

CVE-2026-23918 

CVE-2026-24072 

CVE-2026-28780 

CVE-2026-29168 

CVE-2026-29169 

CVE-2026-33006 

CVE-2026-33007 

CVE-2026-33523 

CVE-2026-33857 

CVE-2026-34032 

CVE-2026-34059  

[PhoneBoy]

Most of these CVEs are for modules/functions we don't use in our implementation, as near as I can tell.
Having said that, if you're looking for an official answer, that'll require a TAC case. 

[genisis__]

Thanks..I will raise a TAC case, for a formal response.

TAC have come back with the below:

• CVE-2026-23918 - Not vulnerable.  The vulnerability affects only Apache HTTP Server 2.4.66; the product ships with version 2.4.61, which is not in the affected range.
• CVE-2026-29168 -  Not vulnerable. mod_md is not shipped with our images. 
• CVE-2026-24072 - Not exploitable. The product does not allow non-administrative users to author .htaccess files. Only the root/admin user has write access to the web tree, so there is no privilege boundary for the bug to cross. Additionally, AllowOverride None is configured, so .htaccess files would be ignored even if planted.
• CVE-2026-29169 - Not exploitable. mod_dav_lock is loaded as a default module but is not configured: no Dav directives and no DavGenericLockDB exist in the Apache configuration.
• CVE-2026-33006 - Not exploitable. The product does not use HTTP Digest authentication.
• CVE-2026-33007 - Not exploitable. The product is not configured as a forward proxy. The vulnerable code path requires a caching forward proxy configuration.
• CVE-2026-33523 - Not exploitable. The product does not relay HTTP responses from untrusted or third-party backend servers. 
• CVE-2026-28780 - Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.
• CVE-2026-33857- Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.
• CVE-2026-34032- Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.
• CVE-2026-34059 - Not exploitable - AJP module is shipped, but not loaded with default configuration. The product does not use the AJP protocol.
  
  Additionally below will be updated as well soon:
   sk182900 - Check Point response to Apache HTTP Server CVEs