What were you trying to do that didn't work?

Security scanners report TRACE/TRACK enabled and identify it as a possible security issue. RHEL should disable TRACE/TRACK by default.

What is the impact of this issue to you?

Nessus, Qualys, and others flagging a security flaw.

https://owasp.org/www-community/attacks/Cross_Site_Tracing

Please provide the package NVR for which the bug is seen:

httpd (all versions)

How reproducible is this bug?:

Always

Steps to reproduce

1. Install httpd
2. curl -X TRACE 127.0.0.1

Expected results

405 Method not allowed

Actual results

TRACE / HTTP/1.1
Host: 127.0.0.1
User-Agent: curl/8.9.1
Accept: /

Additional Information

This is being done by numerous projects piecemeal, but would be better done by the httpd project. See https://issues.redhat.com/browse/RHEL-59772, https://issues.redhat.com/browse/OSPRH-14672, https://issues.redhat.com/browse/RHV-36639 and numerous others.