IBM Support

Fix list for IBM HTTP Server Version 8.5

Product Documentation


Abstract

IBM HTTP Server provides periodic fixes for release 8.5. The following is a complete listing of fixes, with the most recent fix at the top.

Content

Back to all versions

Important: IBM HTTP Server 8.5 is in extended support 

IBM HTTP Server 8.5.5.31

Download Fix Pack 8.5.5.31

Fix release date: 08 September 2026
Last modified: 08 September 2026
Status: Recommended
Security IssueKnown IssueDescription
✓DT497393IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache Portable Runtime Utility (CVE-2025-49506, CVE-2026-32327)
 PH72066Update expat to 2.8.2 or later

Notes:

  1. IBM HTTP Server 8.5.5.31 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.68.
IBM HTTP Server 8.5.5.30

Download Fix Pack 8.5.5.30

Fix release date: 27 July 2026
Last modified: 27 July 2026
Status: Superseded
Security IssueKnown IssueDescription
✓PH70572Vulnerability in IBM HTTP Server used by IBM WebSphere Application Server due to Expat (CVE-2026-32776, CVE-2026-32777, CVE-2026-32778)
✓PH71061IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat
✓PH71265IBM HTTP Server is affected by multiple vulnerabilities (CVE-2026-8855 and more)
✓PH71594IBM HTTP Server is affected by multiple vulnerabilities (CVE-2026-44119 and more)
 PH69738Upgrade GSKit to 8.0.60.5
 PH69843Update bundled expat library to 2.7.4
 PH70248Update embedded zlib to 1.3.2 (Linux, AIX, and Windows only)
 PH70537Conservative defaults for SSLHandshakeTimeout directive

Notes:

  1. IBM HTTP Server 8.5.5.30 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.68.
IBM HTTP Server 8.5.5.29

Download Fix Pack 8.5.5.29

Fix release date: 9 February 2026
Last modified: 9 February 2026
Status: Superseded
Security APARAPARDescription
✓PH67153IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-43394,CVE-2024-42516,CVE-2024-43204)
✓PH68462IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server (CVE-2025-66200, CVE-2025-58098, CVE-2025-65082, CVE-2025-59775, CVE-2025-59375)
 PH66648Remove CBC ciphers from defaults
 PH67551Fix potential bug in PH61590 and add error_log logging
 PH67623Remove SSLRevocationLibCurlEnable in preparation for GSKit change
 PH68378Update the bundled copies of IHS 8.5.5 APR and apr-util projects to match the levels used in IHS 9.0.
 PH68723mod_proxy misc resilience and serviceability improvements
 PH69573Revert dependency on /lib/libzz64.so in mod_deflate (zOS only)

Notes:

  1. IBM HTTP Server 8.5.5.29 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.66.
IBM HTTP Server 8.5.5.28

Download Fix Pack 8.5.5.28

Fix release date: 28 July 2025
Last modified: 28 July 2025
Status: Superseded
Security APARAPARDescription
 PH65829Ensure embedded expat library is always used with an entity handler.

Notes:

  1. IBM HTTP Server 8.5.5.28 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.63.
  2. IBM HTTP Server 8.5.5.28 with PH68462 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.66
IBM HTTP Server 8.5.5.27

Download Fix Pack 8.5.5.27

Fix release date: 10 February 2025
Last modified: 10 February 2025
Status: Superseded
Security APARAPARDescription
✓PH61893IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-38476 and more)
✓PH62263IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-40725, CVE-2024-40898)
 PH61590Trigger operator console or CEEDUMP for children that are slow to exit during shutdown
 PH62717Restrict read permissions on files used to establish SysV shared memory
 PH62889Instrument more Apache hooks with %{RH}e
 PH63077Port fixes from libexpat 2.6.3
 PH64037Backport fixes from expat-2.6.4
 PH64942GSKit 8.0.60.x toleration and non-libcurl CRL/OCSP client

Notes:

  1. IBM HTTP Server 8.5.5.27 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.63.
  2. IBM HTTP Server 8.5.5.27 with IFPH67513 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.64
IBM HTTP Server 8.5.5.26

Download Fix Pack 8.5.5.26

Fix release date: 29 July 2024
Last modified: 29 July 2024
Status: Superseded
Security APARAPARDescription
✓PH59697IBM HTTP Server is vulnerable to a denial of service due to libexpat (CVE-2023-52425 CVSS 7.5).
✓PH60619IBM HTTP Server is vulnerable to HTTP response splitting due to the included Apache HTTP Server (CVE-2024-24795 CVSS 6.5, CVE-2023-38709 CVSS 6.5).
 PH59012Fix possible crashes at the end of apachectl -t. z/OS only.
 PH59165bin/envvars in newly created IHS instances now enables HEAPPOOLS and HEAPPOOLS64 by default. z/OS only.
 PH60306Avoid crash during graceful exit after thread creation errors.
 PH60645Stop reporting a generic SSL0212E for some obscure cases where SSLHandhsakeTimeout was explicitly triggered.
 PH60863Potential crash on Windows at shutdown or when exiting due to MaxRequestsPerChild.

Notes:

  1. IBM HTTP Server 8.5.5.26 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.62.
IBM HTTP Server 8.5.5.25

Download Fix Pack 8.5.5.25

Fix release date: 19 February 2024
Last modified: 19 February 2024
Status: Superseded
Security APARAPARDescription
 PH55613Resolve some cases of "Configuration errors were detected during the installation" due to deleted files
 PH56093IHS child processes crash leaks 1 message queue
 PH56308Default ExtendedStatus to ON
 PH56340Extended reporting of some startup errors
 PH56383Connection not closed as expected after first response of HTTP request smuggling test
 PH57408Log consecutive failing accept() calls and give the option to gracefully exit. z/OS only.

Notes:

  1. IBM HTTP Server 8.5.5.25 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.58.
  2. IBM HTTP Server 8.5.5.25 + IFPH60619 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.59.
IBM HTTP Server 8.5.5.24

Download Fix Pack 8.5.5.24

Fix release date: 31 July 2023
Last modified: 31 July 2023
Status: Superseded
Security APARAPARDescription
✓PH51982IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server and Apache Portable Runtime.
✓PH52546IBM HTTP Server is vulnerable to information disclosure due to IBM GSKit (CVE-2023-32342).
✓PH52754IBM HTTP Server is vulnerable to a denial of service (CVE-2023-26281).
✓PH53014IBM HTTP Server is vulnerable to HTTP request splitting due to the included Apache HTTP Server (CVE-2023-25690).
 PH44893Update GSKit to 8.0.55.31 for new RNG.
 PH51473Remove RSA key exchange ciphers from defaults.
 PH52642Improve error log message for invalid HTTP header name or value by identifying the first bad character.
 PH53848Add %{tzoff}t alternative to %{%z}t on Windows.
 PH54015RewriteRule trailing question mark errors with IFPH53014.
 PH54894Add OCSPCacheSize directive to control the OCSP cache size.
 PH55007bin/set_attributes.sh warning about chatr.

Notes:

  1. IBM HTTP Server 8.5.5.24 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.57.

[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"ARM Category":[{"code":"a8m50000000Cd10AAC","label":"IHS"}],"ARM Case Number":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"8.5.0"}]

Document Information

Modified date:
21 October 2026

UID

swg27036410

Page Feedback