title: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
description: httpd: mod_proxy_wstunnel tunneling of non Upgraded connection pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 httpd: mod_proxy NULL pointer dereference pcre: Integer overflow when parsing callout numeric arguments httpd: Single zero byte stack overflow in mod_auth_digest JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure openssl: Read buffer overruns processing ASN.1 strings openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash() httpd: mod_session: NULL pointer dereference when parsing Cookie header httpd: mod_session: Heap overflow via a crafted SessionHeader value httpd: Unexpected URL matching with 'MergeSlashes OFF' httpd: NULL pointer dereference via malformed requests
cpes: cpe:/a:redhat:jboss_core_services:1