IBM Support

Fix list for IBM HTTP Server Version 9.0

Product Documentation


Abstract

IBM HTTP Server provides periodic fixes for release 9.0. The following is a listing of recent fix packs, with the most recent at the top.

Content

Back to all versions
 
IBM HTTP Server 9.0.5.26

Download Fix Pack 9.0.5.26

Fix release date: 02 December 2025
Last modified: 02 December 2025
Status: Recommended

This fix pack is delivered for z/OS with APAR/PTF: PH67945 / UO04692.

Back to Top
Security APAR
APAR
Description
 PH67551Fix potential bug in PH61590 and add error_log logging
 PH67623Replace SSLRevocationLibCurlEnable with SSLRevocationIHSInternalClientEnable
 PH67676Add additional directories to rpath / runpath of httpd binaries
 PH67714Allow custom post-update scripts on Linux
 PH67897Allow apachectl configtest to check SSL config with -DTEST_SSL_CONFIG
 PH68132Remove HTTP 400 errors related to SNI / Host mismatch which are not meaningful in IHS (AH02032/AH02032)


Notes:

  1. IBM HTTP Server 9.0.5.26 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.65.
  2. IBM HTTP Server 9.0.5.26 with PH68462 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.66.
IBM HTTP Server 9.0.5.25

Download Fix Pack 9.0.5.25

Fix release date: 09 September 2025
Last modified: 09 September 2025
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH67945 / UO04692.

Back to Top
Security APAR
APAR
Description
✓PH67153IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-43394,CVE-2024-42516,CVE-2024-43204)
✓PH67414IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server (CVE-2025-54090 CVSS 6.3)
 PH67529Allow SetEnv to replace native environment variables to avoid IHS bundled libraries from being in CGI shared library path
 PH66648Remove CBC ciphers from defaults
 PH66956Improve resilience of Keep-Alive connections under mpm_event


Notes:

  1. IBM HTTP Server 9.0.5.25 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.65.
IBM HTTP Server 9.0.5.24

Download Fix Pack 9.0.5.24

Fix release date: 17 June 2025
Last modified: 17 June 2025
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH66876 / UO03539.

Back to Top
Security APAR
APAR
Description
 PH64800Add the ihs-force-https option to force HTTPS when TLS is offloaded in front of IBM HTTP Server.
 PH65827Remove support for the obscure DUPNAMES option in the embedded PCRE.
 PH65829Ensure embedded expat library is always used with an entity handler.


Notes:

  1. IBM HTTP Server 9.0.5.24 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.63.
  2. IBM HTTP Server 9.0.5.24 with IFPH67414 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.65
IBM HTTP Server 9.0.5.23

Download Fix Pack 9.0.5.23

Fix release date: 25 March 2025
Last modified: 25 March 2025
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH65617 / UO02425.

Back to Top
Security APAR
APAR
Description
 PH64037Backport fixes from expat-2.6.4.
 PH64942GSKit 8.0.60.x toleration and non-libcurl CRL/OCSP client.


Notes:

  1. IBM HTTP Server 9.0.5.23 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.63.
IBM HTTP Server 9.0.5.22

Download Fix Pack 9.0.5.22

Fix release date: 3 December 2024
Last modified: 3 December 2024
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH64123 / UI99035

Back to Top
Security APAR
APAR
Description
 PH62717Restrict read permissions on files used to establish SysV shared memory
 PH62889Instrument more Apache hooks with %{RH}e
 PH63077Port fixes from libexpat 2.6.3
 PH63338Add DeflateMinLength directive to specify a minimum response length to compress.
 PH63406Under rare/unknown conditions, IHS may continually create threads in child process


Notes:

  1. IBM HTTP Server 9.0.5.22 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.62.
IBM HTTP Server 9.0.5.21

Download Fix Pack 9.0.5.21

Fix release date: 10 September 2024
Last modified: 10 September 2024
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH62977 / UI98223.

Back to Top
Security APAR
APAR
Description
✓PH61893IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-38476 and more)
✓PH62263IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-40725, CVE-2024-40898)
 PH61590Trigger operator console or CEEDUMP for children that are slow to exit during shutdown
 PH61821Add SAN DNSName to bin/quickssl.{sh,bat} in archive installs


Notes:

  1. IBM HTTP Server 9.0.5.21 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.62.
IBM HTTP Server 9.0.5.20

Download Fix Pack 9.0.5.20

Fix release date: 18 June 2024
Last modified: 18 June 2024
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH61744/UI97237

Back to Top
Security APAR
APAR
Description
✓PH60619IBM HTTP Server is vulnerable to HTTP response splitting due to the included Apache HTTP Server (CVE-2024-24795 CVSS 6.5, CVE-2023-38709 CVSS 6.5)
 PH60185Improve management of gracefully exiting processes on event MPM
 PH60306Avoid crash during graceful exit after thread creation errors
 PH60402update libexpat for issues found in 2.6.0
 PH60645SSL handshake timeout logged generically as "SSL0212E: SSL Handshake Failed, Internal unknown error"
 PH60777Add logging and timeouts related to communication between mod_ibm_ssl and sidd
 PH60863mod_mpmstats: Potential crash on Windows at shutdown or MaxRequestsPerChild


Notes:

  1. IBM HTTP Server 9.0.5.20 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.59.
  2. IBM HTTP Server 9.0.5.20 with IFPH62263  contains all applicable security fixes in Apache HTTP Server versions up through 2.4.62.
IBM HTTP Server 9.0.5.19

Download Fix Pack 9.0.5.19

Fix release date: 26 March 2024
Last modified: 26 March 2024
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH60335/UI96099.

Back to Top
Security APAR
APAR
Description
✓PH59697IBM HTTP Server is vulnerable to information disclosure due to the included libexpat (CVE-2023-52425).
 PH57408Log consecutive failing accept() calls and give the option to gracefully exit (z/OS only).
 PH59012Fix possible crashes at the end of apachectl -t.
 PH59165Enable HEAPPOOLS64 on new instances by default.


Notes:

  1. IBM HTTP Server 9.0.5.19 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.58.
  2. IBM HTTP Server 9.0.5.19+IFPH60619 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.59.
IBM HTTP Server 9.0.5.18

Download Fix Pack 9.0.5.18

Fix release date: 12 December 2023
Last modified: 12 December 2023
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH58450/UI94663.

Back to Top
Security APAR
APAR
Description
✓PH57715

IBM HTTP Server is vulnerable to information disclosure due to the included Apache HTTP Server (CVE-2023-31122)

 PH55900Upgrade LDAP SDK and add support for TLS13
 PH56093IHS child processes crash leaks 1 message queue
 PH56097mod_mpmstats AlwaysReport directive overrides ReportInterval
 PH56308Default ExtendedStatus to ON
 PH56340Extended reporting of some startup errors
 PH56383Connection not closed as expected after first response of HTTP request smuggling test


Notes:

  1. IBM HTTP Server 9.0.5.18 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.58.
IBM HTTP Server 9.0.5.17

Download Fix Pack 9.0.5.17

Fix release date: 19 September 2023
Last modified: 19 September 2023
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH56831 / UI93529 (superseded by UI94040)

Back to Top
Security APAR
APAR
Description
 PH54894Add SSLOCSPCacheSize directive to enable and control the the OCSP cache size.
 PH55434Improve ICSF detection on zOS for new instances.
 PH55613Tolerate missing files that are edited post installation, primarily for interim fix installations.


Notes:

  1. IBM HTTP Server 9.0.5.17 with interim fix PH57715 (z/OS PTF UI94155) contains all applicable security fixes in Apache HTTP Server versions up through 2.4.58.
IBM HTTP Server 9.0.5.16

Download Fix Pack 9.0.5.16

Fix release date: 28 June 2023
Last modified: 28 June 2023
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH55173 / UI92324.

Back to Top
Security APAR
APAR
Description
✓PH52546IBM HTTP Server is vulnerable to information disclosure due to IBM GSKit (CVE-2023-32342 CVSS 7.5)
✓PH53014
IBM HTTP Server is vulnerable to HTTP request splitting due to the included Apache HTTP Server (CVE-2023-25690 CVSS 6.1)
 PH44893Update GSKit to 8.0.55.31 for new RNG.
 PH51678Add SSLSupportedCurves directive to allow customization of the curves offered during ECDHE key exchange. On z/OS, secp192r1 and secp224r1 are no longer enabled by default for ECDHE key exchange over TLSv1.2.
 PH52642Improve the error log message for invalid HTTP header name or value by identifying the first bad character.
 PH52860Possible high CPU when at or near MaxClients.
 PH53848Add %{tzoff}t alternative to %{%z}t on Windows.
 PH54015Fix regression in PH53014 interim fixes for RewriteRule with trailing question mark.


Notes:

  1. IBM HTTP Server 9.0.5.16 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.57.
IBM HTTP Server 9.0.5.15

Download Fix Pack 9.0.5.15

Fix release date: 04 April 2023
Last modified: 04 April 2023
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH53479 / UI91167.

Back to Top
Security APAR
APAR
Description
✓PH50316Update bundled expat for CVE-2022-43680, CVE-2017-9233, and CVE-2013-0340.
✓PH51982Multiple vulnerabilities in IBM HTTP Server (CVE-2022-25147, CVE-2022-28331, CVE-2022-37436, CVE-2006-20001).
 PH51473Remove RSA key exchange ciphers from defaults.
 PH51709Add SSLMinimumRSAKeySize directive to reject client certificates with RSA key sizes smaller than the minimum specified.


Notes:

  • IBM HTTP Server 9.0.5.15 with interim fix PH53014 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.56
    • The latest IHS Archive interim fix is packaged with PH48747 https://www.ibm.com/support/pages/node/6987541
IBM HTTP Server 9.0.5.14

Download Fix Pack 9.0.5.14

Fix release date: 22 November 2022
Last modified: 22 November 2022
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH50710 / UI83294.

Back to Top
Security APAR
APAR
Description
✓PH49572Update bundled expat for CVE-2022-40674.
 PH47518Report the average response time of active requests in the WAS plug-in along with WAS plug-in specific request states: TPCN, TPSB, TPWR, TPRB.
 PH47941Providing a second certificate label to SSLServerCert doesn't work unless SNI is enabled.
 PH48168mod_authnz_saf rejects password with a single slash.
 PH48206Add the KeepAliveTimeoutSend408 directive to allow the server to respond with an HTTP 408 response instead of closing KeepAlive connections.
 PH48807SSL_SERVER_* variables may not be accurate with SNI or multiple certificates per virtual host.
 PH49311Upgrade GSKit to 8.0.55.29.


Notes:

  1. IBM HTTP Server 9.0.5.14 with interim fix PH53014 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.56
IBM HTTP Server 9.0.5.13

Download Fix Pack 9.0.5.13

Fix release date: 30 August 2022
Last modified: 30 August 2022
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH48724 / UI82026.

Back to Top
Security APAR
APAR
Description
✓PH46897Multiple vulnerabilities in IBM HTTP Server (CVE-2022-28615, CVE-2022-29404, CVE-2022-30556, CVE-2022-31813, CVE-2022-28614).
 PH46094Add TrackeHooksOption notice to log slow requests at NOTICE level instead of INFO.
 PH47286When logging %h as used in the default log formats, respect changes made by mod_remoteip processing.
 PH47348Add KeepAliveTimeoutDelay to help avoid keepalive races.


Notes:

  1. IBM HTTP Server 9.0.5.13 with interim fix PH53014 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.56
IBM HTTP Server 9.0.5.12

Download Fix Pack 9.0.5.12

Fix release date: 07 June 2022
Last modified: 07 June 2022
Status: Superseded


This fix pack is delivered for z/OS with APAR/PTF: PH46717 / UI80829.

Back to Top
Security APAR
APAR
Description
✓PH44271
Multiple vulnerabilities in IBM HTTP Server (CVE-2022-25313, CVE-2022-25315, CVE-2022-25235, CVE-2022-25236)
✓PH44829
Multiple vulnerabilities in IBM HTTP Server (CVE-2022-22720, CVE-2022-22719, CVE-2022-22721)
 PH43696With SSLFIPSEnable and SSLProxyEngine enabled, handshakes may fail with GSK_ERROR_UNSUPPORTED.
 PH43887IHS may crash in function ap_scan_http_field_content
 PH44114IHS may appear to hang if MaxRequestsPerChild is nonzero, because a replacement process will not be launched
 PH44330IBM HTTP Server has unnecessary APF authorization on binary files
 PH44393IHS can crash in function ap_scan_http_field_content when processing special characters in URLs or headers


Notes:

  1. IBM HTTP Server 9.0.5.12 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.53.
  2. IBM HTTP Server 9.0.5.12 with interim fix PH50316 (z/OS PTF UI80986 (prior APAR)) contains all applicable security fixes in Apache HTTP Server versions up through 2.4.54.
IBM HTTP Server 9.0.5.11
 
Fix release date: 15 March 2022
Last modified: 15 March 2022
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH44633 / UI7961.
Back to Top
Security APAR
APAR
Description
✓
PH42862
Multiple vulnerabilities in IBM HTTP Server (CVE-2021-44790 CVSS 9.8 and more)
✓
PH43122
Multiple vulnerabilities in IBM HTTP Server (CVE-2022-23852 CVSS 9.8 and more)
 PH41074logresolve.exe doesn't work on Windows
 PH41075Add option to terminate all child processes if the parent process crashes (z/OS only)
 PH41413Recover from a stale pidfile (z/OS only)
 PH41945Potential hang with nonzero MaxRequestsPerChild
 PH42030Potential crash in the sidDelete function
 PH42072Potential crash during LDAP authentication in set_parent_child_pointers
 PH44045Windows archive postinstall.bat fails to copy GSkit to plug-in directory on upgrade


Notes:

  1. IBM HTTP Server 9.0.5.11 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.52.
  2. IBM HTTP Server with interim fix PH44829 (z/OS PTF: UI79752) contains all applicable security fixes in Apache HTTP Server versions up through 2.4.53.
  3. Installing 9.0.5.11 on top of 9.0.5.10 with recent recommended interim fixes may warn about several fixes (APARS) being uninstalled.  Details available here: https://www.ibm.com/support/pages/node/6562241
IBM HTTP Server 9.0.5.10

Download Fix Pack 9.0.5.10

Fix release date: 03 December 2021
Last modified: 03 December 2021
Status: Superseded

This fix pack is delivered for z/OS with APAR/PTF: PH42261 / UI7829.

Back to Top
 
Security APAR
APAR
Description
✓
PH40343
Multiple vulnerabilities in IBM HTTP Server (CVE-2021-40438, CVE-2021-34798, CVE-2021-39275)
https://www.ibm.com/support/pages/node/6493841
 PH39660IHS may crash at startup in the sigaction() system call
 PH39916Omit plug-in keystore from IHS SMPE installations
 PH39992TLSv13 connections may fail with SSL0209E errors reported in the log on z/Linux
 PH40554SMPJHOME serviceability update to error messages
 PH40691Shrink window for mod_unique_id duplicates
 PH40725Avoid possible crashes when graceful restarts are requested rapidly / during startup.
 PH40832Upgrade GSKit to 8.0.55.25
 PH41432Windows IHS archive:s Fix plug-in path generated by postinst.bat


Note:

  • IBM HTTP Server 9.0.5.10 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.51.
  • IBM HTTP Server 9.0.5.10 with interim fix PH42862 (PTF UI78904) contains all applicable security fixes in Apache HTTP Server versions up through 2.4.52.
Fix Pack 9 (9.0.5.9)
Fix release date: 10 September 2021
Last modified: 10 September 2021
Status: Superseded

Download Fix Pack 9.0.5.9

This fix pack is delivered for z/OS with APAR/PTF: PH40044 / UI7696.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PH38515ErrorDocuments that specify literal strings are not translated correctly (z/OS only).
 PH38112Conditionally reduce severity of SSL0405E message for sockets that are already in lingering close.
 PH37899If mod_backtrace is not loaded, dump a backtrace during whatkilledus report (Linux only).
 PH36870Disable the TLS protocols TLSv10 and TLSv11 by default. Remove TLSv1.3 CCM ciphers from defaults.

 


Note:

  • IBM HTTP Server 9.0.5.9 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.48.
  • IBM HTTP Server 9.0.5.9 with interim fix PH42862 (PTF UI78904) contains all applicable security fixes in Apache HTTP Server versions up through 2.4.52.

 

 

 

Fix Pack 8 (9.0.5.8)
Fix release date: 18 June 2021
Last modified: 18 June 2021
Status: Superseded

Download Fix Pack 9.0.5.8

This fix pack is delivered for z/OS with APAR/PTF: PH37767 / UI7584.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PH35771
Multiple vulnerabilities in IBM HTTP Server (CVE-2020-13938, CVE-2021-30641)
https://www.ibm.com/support/pages/node/6463587
 PH35915Upgrade bundled GSKit security library to 8.0.55.21
 PH35107Possible crash with StrictHostCheck
 PH36939z/OS module updates
 PH34420Server fails to start when SSLCipherSpec 30 is set in httpd.conf
 PH34246ErrorLogFormat may not be used by some startup messages
 PH33679SSLCLientAuth doesn't work with 'noverify' and 'crl' together.

 


Note: IBM HTTP Server 9.0.5.8 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.48.

 

 

 

Fix Pack 7 (9.0.5.7)
Fix release date: 26 March 2021
Last modified: 26 March 2021
Status: Superseded

Download Fix Pack 9.0.5.7

This fix pack is delivered for z/OS with APAR/PTF: PH35153 / UI7446.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PH29569Support 'CertificateUsername' without authentication
 PH30270Allow SSL IOVEC merging to be disabled
 PH30598Support '-RSA' pseudo-cipher in SSLCipherSpec to remove ciphers with RSA key exchange
 PH30795Delays with large PKCS11 keystores (GSKit upgrade to 8.0.55.19)
 PH30841Provide a flag to disable TLS close_notify alert on Apache socket close
 PH30854Rewrite backreference escaping needs flexibility
 PH31169Adjust SSL0200E with GSK_ERROR_PROTOCOL_MISMATCH
 PH31409Can't set SSLV3TIMEOUT with TLS13
 PH32229Provide automatic graceful termination of processes reporting SSL0209E/SSL0212E/SSL0203E

 


Note: IBM HTTP Server 9.0.5.7 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.46.

 

 

 

Fix Pack 6 (9.0.5.6)
Fix release date: 27 November 2020
Last modified: 27 November 2020
Status: Superseded

Download Fix Pack 9.0.5.6

This fix pack is delivered for z/OS with APAR/PTF: PH31572 / UI7261.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PH27406Software license swidtag files are not included in the IHS archive installs
 PH27739SSL0401E during 'apachectl stop'
 PH28073IBM HTTP Server on Windows crashes at startup with rare LoadModule value
 PH28389install_ihs fails when ls alias is used
 PH29026setupadmn fails if existing target user is not specified in /etc/passwd
 PH305419.0 install_ihs/install_plug-in error with WAS 855
 PH30660Install Visual C++ Redistributable 2013 needed by IHS on Windows

 


Note: IBM HTTP Server 9.0.5.6 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.46.

 

 

 

Fix Pack 5 (9.0.5.5)
Fix release date: 04 September 2020
Last modified: 04 September 2020
Status: Superseded

Download Fix Pack 9.0.5.5

This fix pack is delivered for z/OS with APAR/PTF: PH28542 / UI7123.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PH24262postinst reports wrong port number
 PH24265Allow mpmstats to write to zOS system log
 PH24402Post Installer for IHS archive should fail if postinst fails
 PH24557Default cipher specs used with SSLCipherSpec ALL -CIPHER_SPEC
 PH26048Add additional information to AH01220 for CGI script timeout

 


Note: IBM HTTP Server 9.0.5.5 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.46.

 

 

 

 

Fix Pack 4 (9.0.5.4)
Fix release date: 12 June 2020
Last modified: 12 June 2020
Status: Superseded

Download Fix Pack 9.0.5.4

9.0.5.4 is delivered for z/OS with APAR/PTF: PH25610 / UI6982.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PH21992Multiple vulnerabilities in IBM HTTP Server (CVE-2020-1927, CVE-2020-1934)
https://www.ibm.com/support/pages/node/6191631
 PH20989Expose SAN fields in client certificates
 PH21717Relax hostname validation in IBM HTTP Server
 PH21804SSL0212E with TLS1.3 when SSLV3Timeout expires
 PH22727Keepalive connections may be closed up to 100ms early
 PH23344Error during script to apply a IHS PTF doesn't cause the PTF apply to fail
 PH23397SSLClientAuthVerify OFF improvement for expired certificates
 PH23551CGI error handling improvement
 PH23596bin/rotatelogs not shipped with program control
 PH23893Add 64-bit IHS for Windows to IIM
 PH24493SSL0209E with IHS 9.0.5.2 and later  (GSKit upgrade to 8.0.55.15)

 


Note: IBM HTTP Server 9.0.5.4 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.43.

 

 

 

 

Fix Pack 3 (9.0.5.3)
Fix release date: 20 March 2020
Last modified: 20 March 2020
Status: Superseded

Download Fix Pack 9.0.5.3

9.0.5.3 is delivered for z/OS with APAR/PTF: PH23038 / UI6832.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PH19074Provide extended diagnostics for SSL0279E errors
 PH20613SSL0232W with SSLFIPSEnable
 PH20970Improve Request header modification flexibility

 


Note: IBM HTTP Server 9.0.5.3 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.41.

 

 

 

 

Fix Pack 2 (9.0.5.2)
Fix release date: 13 December 2019
Last modified: 13 December 2019
Status: Superseded

Download Fix Pack 9.0.5.2

9.0.5.2 is delivered for z/OS with APAR/PTF: PH19272 / UI6665.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PH13105Upgrade bundled GSKit security library
 PH17056Request for dataset with encoded characters returns 404 when using SAFRunAsEarly 
(z/OS only)
 PH17128Add TLS 1.3 support for IBM HTTP Server and the WebSphere Application Server WebServer plug-in
 PH17652Truncated responses that fail with GSK_INVALID_BUFFER_SIZE in IBM HTTP Server 
 PH18102Improve multi-certificate support in IBM HTTP Server 9.0

 


Note: IBM HTTP Server 9.0.5.2 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.41.

 

 

 

 

Fix Pack 1 (9.0.5.1)
Fix release date: 20 September 2019
Last modified: 20 September 2019
Status: Superseded

Download Fix Pack 9.0.5.1

9.0.5.1 is delivered for z/OS with APAR/PTF: PH16280 / UI6533.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PH14974
Multiple vulnerabilities in IBM HTTP Server (CVE-2018-20843, CVE-2019-10092, CVE-2019-10098)
https://www.ibm.com/support/pages/node/964768
 PH10089install-ihs -group should make more directories group writeable  (z/OS only)
 PH10103Enable RLimitCPU on z/OS.  (z/OS only)
 PH10382Enable TLSV1.2 under SSLFIPSEnable
 PH12421AuthLDAPURL not allowing specification of RACFID unless user has RACF search permission  (z/OS only)
 PH13615IBM HTTP Server 9.0 should allow relative URL in redirects.

 


Note: IBM HTTP Server 9.0.5.1 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.41.

 

 

 

 

Refresh Pack (9.0.5)
Fix release date: 28 June 2019
Last modified: 28 June 2019
Status: Superseded

Download Refresh Pack 9.0.5.0

9.0.5.0 is delivered for z/OS with APAR/PTF: PH13435 / UI6383.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PH09869
Multiple vulnerabilities in IBM HTTP Server (CVE-2019-0211, CVE-2019-0220)
https://www-01.ibm.com/support/docview.wss?uid=ibm10880413
 PH07089Suppress parsing of $-prefixed variables in SSI (embeds).  (z/OS only)
 PH07275Unable to change service description of an 'IBM HTTP Server' service on Windows
 PH08035Improve IHS logs on z/OS to show installation details.  (z/OS only)
 PH09519Allow MVSDS to only use the last qualifier of a dataset name for mime extension checking.  (z/OS only)
 PH12690Add the mod_request module for z/OS.  (z/OS only)

 


Note: IBM HTTP Server 9.0.5.0 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.39.

 

 

 

 

Fix Pack 11 (9.0.0.11)
Fix release date: 05 April 2019
Last modified: 05 April 2019
Status: Superseded

Download Fix Pack 11

This fix pack is delivered for z/OS with APAR/PTF: PH10037 / UI6211.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PH06010Security vulnerability in the IBM HTTP Server (CVE-2018-17199)   (Distributed only)
http://www-01.ibm.com/support/docview.wss?uid=ibm10869064
 PH02406Need simpler way to reject unknown hostnames
 PH02448Improve mod_status output for event MPM
 PH03059ABENDEC6 RC FF0F seen at server startup using rotatelogs (z/OS only)
 PH03953'Server reached MaxRequestWorkers' message is issued while idle threads are available
 PH05560Using multiple environment variables in a directive doesn't work
 PH05575Postinst logs unexpected message when failed to find an FQDN
 PH05852Allow headers to be unset using regex

 


Note: IBM HTTP Server 9.0.0.11 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.38.

 

 

 

 

Fix Pack 10 (9.0.0.10)
Fix release date: 14 December 2018
Last modified: 14 December 2018
Status: Superseded

Download Fix Pack 10

This fix pack is delivered for z/OS with APAR/PTF: PH06005 / UI60127
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PH01222Timeout setting for OCSP on IBM HTTP Server
 PH01302Accept SHA2 cert chains in LDAP connections

 


Note: IBM HTTP Server 9.0.0.10 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.37.

 

 

 

Fix Pack 9 (9.0.0.9)
Fix release date: 21 September 2018
Last modified: 21 September 2018
Status: Superseded

Download Fix Pack 9

This fix pack is delivered for z/OS with APAR/PTF: PH02525 / UI5847.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 
PI95964Add mod_cgi directive to allow users to configure timeouts for CGI applications
 
PI96156SSL fails with multiple addresses in single VirtualHost
 PI96321Update embedded LDAP SDK to 6.4.x
 PI96949The file time stamp format of IHS 9.0 is different from IHS 8.5
 PI96955Allow mod_substitute for proxied responses
 PI97314Add mod_backtrace for Windows
 PI98116PDB files are not shipped for plug-in and odrlib in the Windows archive installer.
 PI98146Only create rewrite map lock if RewriteMaps are used.
 PI98147Print unparsed URI in the 'URI incorrectly encoded' error message
 PI98705HTML-encoded SSI variable double-encoded when moving to IHS 9.0
 PI99032SSL alerts not showing in log messages
 PI99262Reduce memory used by persistent connections
 PI99271AuthzProviderAlias ignoring all Require-Parameters except first one.
 PI99394IBM HTTP Server startup messages not switching to Errorlog (z/OS only)
 PI99567HTTPProtocolOptions improvements
 PI99680rotatelogs description should include option -n
 PI99685HTTPProtocolOptions=unsafe should allow a space in a header
 PH00889LeaveWorkUnit errors with mod_wlm (z/OS only)

 


Note: IBM HTTP Server 9.0.0.9 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.34.

 

 

 

Fix Pack 8 (9.0.0.8)
Fix release date: 29 June 2018
Last modified: 29 June 2018
Status: Superseded

Download Fix Pack 8

This fix pack is delivered for z/OS with APAR/PTF: PI99702 / UI5692.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PI94222Multiple vulnerabilities in GSKit bundled with IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22015347
✓
PI95670Multiple vulnerabilities in IBM HTTP Server (CVE-2017-15710, CVE-2017-15715,CVE-2018-1301)
http://www-01.ibm.com/support/docview.wss?uid=swg22015344
 PI91850MVSDS does not list member contents when using relative generation number to create a member list with PDS/PDSE GDG (z/OS only)
 PI91975The 'Header unset Content-Type' directive does not unset the Content-Type response header.
 PI92017Include CGI program name when writing stderr to the error log when using mod_cgi
 PI92053Let child processes avoid graceful shutdown if ECONNREFUSED, ECONNABORTED, ECONNRESET occur during client accept().
 PI92092FSUM6245 seen when upgrading IHS to a new fix pack and using an intermediate symbolic link (z/OS only)
 PI92407Log startup message for low 64-bit MEMLIMIT
 PI93212Throttle SSL0600E error messages
 PI94050High CPU/Hang with IHS mod_auth_basic LDAP
 PI94539mod_proxy_http does not allow headers larger than 8K bytes.
 PI95610Namespace collision when mod_ibm_ssl.so is loaded alongside libodr.so.

 


Note: IBM HTTP Server 9.0.0.8 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.33.

 

 

 

Fix Pack 7 (9.0.0.7)
Fix release date: 16 March 2018
Last modified: 16 March 2018
Status: Superseded

Download Fix Pack 7

This fix pack is delivered for z/OS with APAR/PTF: PI94851 / UI5433.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PI90598CVE-2017-12613 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22013598
 PI90688gskcapicmd on Linux not working in IHS V9
 PI90811rotatelogs fails with relative paths in IBM HTTP Server V9
 PI91038When client and IHS don't support the same SSL/TLS version, IHS logged incorrect message in error log
 PI91075Add environment variable to record "SSLVersion" failure
 PI91351Add toleration for TLS certificate extension InhibitAnyPolicy marked as non-critical
 PI91720HTTPS download of IHS archive install from Fix Central results in uncompressed file with misleading name

 


Note: IBM HTTP Server 9.0.0.7 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.29.

 

 

 

 

Fix Pack 6 (9.0.0.6)
Fix release date: 21 December 2017
Last modified: 21 December 2017
Status: Superseded

Download Fix Pack 6

This fix pack is delivered for z/OS with APAR/PTF: PI91366 / UI5273.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PI87445CVE-2017-9798 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22009782
✓
PI87663CVE-2017-12618 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22009782
 PI84868Disable the 3DES cipher by default in IBM HTTP Server.
 PI85561SSL Fallback Protection related errors with SSLProxyEngine ON
 PI85702SAFRunAs %%CERTIF%% asks for basic auth credentials
 PI85804Improve password failure error messages in authnz_saf
 PI87046Microsoft Windows large address support was not ported in IBM HTTP Server 9.0.0.4
 PI88232Allow the server to handle requests with obsolete folds containing only spaces and/or tabs after PI73984.
 PI88356Default ciphers with SSLFIPSEnable are System SSL defaults instead of IHS defaults.
 PI88553Print an error message that includes the errno and errno2 values if fail to find a specified saf-group.
 PI90141IBM HTTP Server may hang at startup on z/Linux running on z14 hardware - upgrade GSKit to 8.0.50.84
 PI90834abendoc4 in apr_pstrcat using saf-change-pw handler

 


Note: IBM HTTP Server 9.0.0.6 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.29.

 

 

 

 

Fix Pack 5 (9.0.0.5)
Fix release date: 17 October 2017
Last modified: 13 October 2017
Status: Superseded

Download Fix Pack 5

This fix pack is delivered for z/OS with APAR/PTF: PI87801 / UI50746.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PI82260CVE-2017-3167 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22005280
✓
PI82263CVE-2017-7668 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22005280
✓
PI82481CVE-2017-7679 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22005280
 PI80356Upgrade bundled GSKit security library (Distributed only)
 PI81360Allow SSL_/TLS_ prefixes to be used interchangeably for cipher long names
 PI81602Issues with updating SAF password when using Firefox or Chrome (z/OS only)
 PI82760Unable to launch ikeyman on the IBM HTTP Server side.
 PI82834Add a simple PCT alternative for IBM HTTP Server with Liberty.
 PI83167Support for binary-only install via IHS_SKIP_POSTINST environment variable.
 PI83257Reduce memory usage from long mod_rewrite configurations.
 PI83350Add jobname and job id to SMF 103 records for IBM HTTP Server (z/OS only)

 


Note: IBM HTTP Server 9.0.0.5 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.27.

 

 

 

 

Fix Pack 4 (9.0.0.4)
Fix release date: 13 June 2017
Last modified: 13 June 2017
Status: Superseded

Download Fix Pack 4

This fix pack is delivered for z/OS with APAR/PTF: PI82358 / UI47689.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PI73043Upgrade bundled GSKit security library (Distributed only)
 PI74780Allow IBM HTTP Server 9.0 on AIX 6.1
 PI75835ABEND0C4 in IBM HTTP Server 9.0 using -v option with rotatelogs (z/OS only)
 PI76757Allow SSL handshake transcripts to be enabled or disabled
 PI76874Further enhancements to PI50937 high cpu avoidance
 PI76918'Permission denied' errors after maintenance upgrade of IBM HTTP Server on z/OS (z/OS only)
 PI77337IHS LDAP connection with SSL not working
 PI77697IBM HTTP Server 9.0 install not creating service correctly on Microsoft Windows
 PI78442Some sequences of server-side includes mixing '#include virtual=' and '#include file=' result in a HTTP 400 error.
 PI78696SSL handshake failure between IHS/Proxy to backend IHS/Plug-in
 PI78716File is not translated using MVSDS if content-encoding is used with IBM HTTP Server 9.0 (z/OS only)
 PI78967Allow CEEDUMPS to be requested with kill -USR2 (z/OS only)
 PI80106500 Internal error with 'AH01328: Line too long' (z/OS only)
 PI80187Redirect functionality not working as expected for MVSDS requests (z/OS only)
 PI80447Disable MMAP for static files by default on z/OS (z/OS only)

 


Note: IBM HTTP Server 9.0.0.4 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.25.

 

 

 

 

Fix Pack 3 (9.0.0.3)
Fix release date: 14 March 2017
Last modified: 14 March 2017
Status: Superseded

Download Fix Pack 3

This fix pack is delivered for z/OS with APAR/PTF: PI77285 / UI45080.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PI73984CVE-2016-8743 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21996847
 PI70372mod_mvsds serves a plain text file as an html page if it contains any string starting with a '<' and ending with a '>'.
 PI70496Startup failures when 'SSLEnable' is specified globally instead of within a VirtualHost.
 PI70825Simplify mod_ibm_ssl trace enabling in IBM HTTP Server 9.0
 PI70829Provide additional message information for IBM HTTP Server TLS handshakes
 PI71340Update ikeyman/gskcmd wrappers for IBM HTTP Server 8.5.5 and 9.0 with embedded Java 8.
 PI72989Hangs related to mod_backtrace and mod_whatkilledus during a crash.
 PI73027Crash with combination of mod_net_trace loaded and 'EnableSendfile ON' in httpd.conf.
 PI73165High cpu encountered when directive EnableSendfile is set to On
 PI73661Session ID Daemon (sidd) memory leak
 PI73819Allow an extended syntax for the SSLCipherSpec directive on z/OS
 PI73951mod_zos_cmds incorrectly reports the number of lingering close connections as zero.
 PI74200Connection resets under heavy load when connecting to IHS on z/OS.

 


Note: IBM HTTP Server 9.0.0.3 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.25.

 

 

 

 

Fix Pack 2 (9.0.0.2)
Fix release date: 13 December 2016
Last modified: 13 December 2016
Status: Superseded

Download Fix Pack 2

This fix pack is delivered for z/OS with APAR/PTF: PI72454 / UI42701.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PI66849CVE-2012-0876, CVE-2012-1148, CVE-2016-4472
expat vulnerability fixes for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21988026
 PI66468bin\ikeyman.bat and bin\gskcmd.bat don't work when IHS install path contains spaces
 PI66787Session cache daemon (sidd) memory leak
 PI66931Upgrade bundled GSKit security library to resolve TLS > 1.2 negotiation intolerance.
 PI67595AuthSAFExpiration and AuthSAFReenter do not work when using a 401 errordocument (z/OS only)
 PI68001Add ability for the MVS stop command to do a graceful shutdown of the server (z/OS only)
 PI68803IHS on z/OS CPU usage increases in release 8.5.5.5 or beyond (z/OS only)
 PI69081gskver, ikeyman, gskcapicmd, and gskcmd scripts do not work in IBM HTTP Server 9.0.0.1
 PI69182IBM HTTP Server 9.0 SSL cipher defaults may be displayed incorrectly on z/OS (z/OS only)
 PI69979Accept non strictly-conforming X509 certificates in IBM HTTP Server 9.0
 PI70022Allow IBM HTTP Server on Linux to automatically raise ulimit -n to accomodate larger ThreadsPerChild

 


Note: IBM HTTP Server 9.0.0.2 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.23.

 

 

 

 

Fix Pack 1 (9.0.0.1)
Fix release date: 16 September 2016
Last modified: 16 September 2016
Status: Superseded

Download Fix Pack 1

This fix pack is delivered for z/OS with APAR/PTF: PI68703 / UI40714.
Back to Top

 

 

 

 
Security APAR
APAR
Description
✓
PI63098CVE-2016-0718 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21988026
✓
PI65855CVE-2016-5387 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21988019
 PI60251mod_mvsds writes content as binary instead of text/plain (z/OS only)
 PI60784IBM HTTP Server directives SSLCipherBan and SSLCipherRequire may crash when GSKit tracing is enabled
 PI62663Some Server Side Includes (SSI) may not be translated as expected (z/OS only)
 PI63482Add a private header with password change information for 401 response.
 PI63682IHS mod_status displays many 'NULL' strings in request column
 PI64346SetEnvIf may be skipped with SAF auth enabled (z/OS only)
 PI64628IBM HTTP Server on Z/OS is deleting the wrong message queue (z/OS only)
 PI66153XML datasets with no XML extension cause error under mod_mvsds (z/OS only)
 PI66183When MFA is configured, SAFRunAs fails with a permission error (z/OS only)

 


Note: IBM HTTP Server 9.0.0.1 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.23.

 

 

 

 

9.0.0.0 (9.0.0.0-PI56034)
Fix release date: 24 June 2016
Last modified: 24 June 2016
Status: Superseded

Download 9.0.0.0

This release was delivered for z/OS as an IM (Installation Manager) installed version only. For SMPE install, these contents were not available until 9.0.0.1.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PI53754Using MVSDS to retrieve a GDG(0) always returns the same file, even after a new generation is created (z/OS only)
 PI56034No equivalent functionality for DGW AlwaysWelcome directive in IHS on z/OS (z/OS only)
 PI56576Incorrect image path in .css file causes image to not display
 PI57543Allow one address space per rotatelogs process to be conserved. (z/OS only)
 PI57596CRIHS0001I may contain garbage information or not pick up HTTPS port (z/OS only)
 PI58218IBM HTTP Server mod_cache fixes
 PI59561Add pre/post password hooks to mod_authnz_saf
 PI60207Upgrade bundled GSKit security library to 8.0.50.61

 


Note: IBM HTTP Server 9.0.0.0 contains all applicable security fixes in Apache HTTP Server versions up through 2.4.20.

 

 

 

 

9.0.0.0-PI54808
Fix release date: 02 March 2016
Last modified: 02 March 2016
Status: Superseded

This release was not delivered for distributed platforms or with WebSphere Application Server. It was delivered for z/OS only via APAR/PTF: PI56777 / UI35362.
Back to Top

 

 

 

 
Security APAR
APAR
Description
 PI48857Some headers are removed when caching is enabled
 PI50376DGW compatibility for DOCUMENT_* CGI variables. (z/OS only)
 PI50397No error log entries for 'SAFRunAs %%CERTIF_REQ%%' failures. (z/OS only)
 PI50514SSL session ID cache daemon (SIDD) creates unnecessary entries
 PI51185Enhancements allowing use of SAFRunAsEarly for certificate switching (z/OS only)
 PI52301Reduce reads to /dev/random causing CSFSERV CSFRNG access (z/OS only)
 PI54808RewriteRule sees un-decoded characters in URL when mod_authnz_saf loaded (z/OS only)

 

 

 

 

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"ARM Category":[{"code":"a8m50000000Cd10AAC","label":"IHS"}],"ARM Case Number":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"9.0.0;9.0.5","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
15 December 2025

UID

swg27048481

Page Feedback