IBM Support

Fix list for IBM HTTP Server Version 9.0

Product Documentation


Abstract

IBM HTTP Server provides periodic fixes for release 9.0. The following is a listing of recent fix packs, with the most recent at the top.

Content

Back to all versions
The latest cumulative security interim fix is available here: https://ibm.biz/IHSCumulativeSecurityInterimFix
IBM HTTP Server 9.0.5.29

Download Fix Pack 9.0.5.29

Fix release date: 08 September 2026
Last modified: 08 September 2026
Status: Recommended

This fix pack is delivered for z/OS with APAR/PTF: PH73011 / UO09221.
Security IssueKnown IssueDescription
✓DT497393IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache Portable Runtime Utility (CVE-2025-49506, CVE-2026-32327, CVE-2026-34191, CVE-2026-34502)
✓PH71265IBM HTTP Server is affected by multiple vulnerabilities (CVE-2026-8855 and more)
✓PH71594IBM HTTP Server is affected by multiple vulnerabilities (CVE-2026-44119 and more)
 PH72066Update expat to 2.8.2 or later

Notes:

  1. IBM HTTP Server 9.0.5.29 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.68.
  2. IBM HTTP Server 9.0.5.29 with the latest cumulative security interim fix contains all applicable security fixes in Apache HTTP Server versions up through 2.4.69
IBM HTTP Server 9.0.5.28

Download Fix Pack 9.0.5.28

Fix release date: 16 June 2026
Last modified: 16 June 2026
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH71646 / UO08189.
Security APARAPARDescription
✓PH70572Vulnerability in IBM HTTP Server used by IBM WebSphere Application Server due to Expat (CVE-2026-32776, CVE-2026-32777, CVE-2026-32778)
✓PH71061IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat (CVE-2026-33523, CVE-2026-41080, CVE-2026-24072)
 PH69738Upgrade GSKit to 8.0.60.5
 PH70112Scripts added to conf/postinst.d don't run with a reliable PATH, or run-parts itself fails referring to basic system commands like basename
 PH70248Update embedded zlib to 1.3.2 (Linux, AIX, and Windows only)

Notes:

  1. IBM HTTP Server 9.0.5.28 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.67
  2. IBM HTTP Server with IFPH71594 or later contains all applicable security fixes in Apache HTTP Server versions up through 2.4.68
IBM HTTP Server 9.0.5.27

Download Fix Pack 9.0.5.27

Fix release date: 24 March 2026
Last modified: 24 March 2026
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH70472 / UO07096.
Security APARAPARDescription
✓PH68462IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server (CVE-2025-58098, CVE-2025-59375, CVE-2025-59775, CVE-2025-65082, CVE-2025-66200)
 PH69843Update the bundled copy of expat to 2.7.4.
 PH69573Revert dependency on /lib/libzz64.so in mod_deflate.
 PH69649Add IgnoreModule directive.
 PH69769Update open source dependencies of IBM HTTP Server.
 PH69947Fix possible crash on Linux or z/OS in process_socket() after PH66956.

Notes:

  1. IBM HTTP Server 9.0.5.27 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.66.

    IBM HTTP Server with the latest cumulative security interim fix contains all applicable security fixes in Apache HTTP Server versions up through 2.4.67.
IBM HTTP Server 9.0.5.26

Download Fix Pack 9.0.5.26

Fix release date: 02 December 2025
Last modified: 02 December 2025
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH67945 / UO04692.
Security APARAPARDescription
 PH67551Fix potential bug in PH61590 and add error_log logging
 PH67623Replace SSLRevocationLibCurlEnable with SSLRevocationIHSInternalClientEnable
 PH67714Allow custom post-update scripts on Linux (note: not usable until PH70112)
 PH67897Allow apachectl configtest to check SSL config with -DTEST_SSL_CONFIG
 PH68132Remove HTTP 400 errors related to SNI / Host mismatch which are not meaningful in IHS (AH02032/AH02032)

Notes:

  1. IBM HTTP Server 9.0.5.26 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.65.
  2. IBM HTTP Server 9.0.5.26 with PH68462 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.66.
IBM HTTP Server 9.0.5.25

Download Fix Pack 9.0.5.25

Fix release date: 09 September 2025
Last modified: 09 September 2025
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH67945 / UO04692.
Security APARAPARDescription
✓PH67153IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-43394,CVE-2024-42516,CVE-2024-43204)
✓PH67414IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server (CVE-2025-54090 CVSS 6.3)
 PH67529Allow SetEnv to replace native environment variables to avoid IHS bundled libraries from being in CGI shared library path
 PH66648Remove CBC ciphers from defaults
 PH66956Improve resilience of Keep-Alive connections under mpm_event

Notes:

  1. IBM HTTP Server 9.0.5.25 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.65.
IBM HTTP Server 9.0.5.24

Download Fix Pack 9.0.5.24

Fix release date: 17 June 2025
Last modified: 17 June 2025
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH66876 / UO03539.
Security APARAPARDescription
 PH64800Add the ihs-force-https option to force HTTPS when TLS is offloaded in front of IBM HTTP Server.
 PH65827Remove support for the obscure DUPNAMES option in the embedded PCRE.
 PH65829Ensure embedded expat library is always used with an entity handler.

Notes:

  1. IBM HTTP Server 9.0.5.24 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.63.
  2. IBM HTTP Server 9.0.5.24 with IFPH67414 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.65
IBM HTTP Server 9.0.5.23

Download Fix Pack 9.0.5.23

Fix release date: 25 March 2025
Last modified: 25 March 2025
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH65617 / UO02425.
Security APARAPARDescription
 PH64037Backport fixes from expat-2.6.4.
 PH64942GSKit 8.0.60.x toleration and non-libcurl CRL/OCSP client.

Notes:

  1. IBM HTTP Server 9.0.5.23 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.63.
IBM HTTP Server 9.0.5.22

Download Fix Pack 9.0.5.22

Fix release date: 3 December 2024
Last modified: 3 December 2024
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH64123 / UI99035
Security APARAPARDescription
 PH62717Restrict read permissions on files used to establish SysV shared memory
 PH62889Instrument more Apache hooks with %{RH}e
 PH63077Port fixes from libexpat 2.6.3
 PH63338Add DeflateMinLength directive to specify a minimum response length to compress.
 PH63406Under rare/unknown conditions, IHS may continually create threads in child process

Notes:

  1. IBM HTTP Server 9.0.5.22 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.62.
IBM HTTP Server 9.0.5.21

Download Fix Pack 9.0.5.21

Fix release date: 10 September 2024
Last modified: 10 September 2024
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH62977 / UI98223.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"ARM Category":[{"code":"a8m50000000Cd10AAC","label":"IHS"}],"ARM Case Number":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"9.0.0;9.0.5","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
14 October 2026

UID

swg27048481

Page Feedback