[CLSA-2026:1792508142] Fix of 10 CVEs
Type:
security
Severity:
Critical
Release date:
2026-10-20 14:55:59 UTC
Description:
* SECURITY UPDATE: mod_charset_lite: heap overflow in finish_partial_char - debian/patches/CVE-2026-56153.patch: mod_charset_lite: heap overflow in finish_partial_char - CVE-2026-56153 * SECURITY UPDATE: mod_heartmonitor: NULL pointer dereference on malformed heartbeat - debian/patches/CVE-2026-46729.patch: mod_heartmonitor: NULL pointer dereference on malformed heartbeat - CVE-2026-46729 * SECURITY UPDATE: mod_rewrite: use-after-free via LA-U lookahead variables - debian/patches/CVE-2026-56154.patch: mod_rewrite: use-after-free via LA-U lookahead variables - CVE-2026-56154 * SECURITY UPDATE: mod_proxy_html: out-of-bounds write in dump_content - debian/patches/CVE-2026-56449.patch: mod_proxy_html: out-of-bounds write in dump_content - CVE-2026-56449 * SECURITY UPDATE: mod_vhost_alias: stack overflow with oversized Host header - debian/patches/CVE-2026-63292.patch: mod_vhost_alias: stack overflow with oversized Host header - CVE-2026-63292 * SECURITY UPDATE: mod_proxy_uwsgi: response smuggling via Transfer-Encoding - debian/patches/CVE-2026-63718.patch: mod_proxy_uwsgi: response smuggling via Transfer-Encoding - CVE-2026-63718 * SECURITY UPDATE: mod_http2: use-after-free via shared session bbtmp re-entrancy - debian/patches/CVE-2026-57941.patch: mod_http2: use-after-free via shared session bbtmp re-entrancy - CVE-2026-57941 * SECURITY UPDATE: mod_xml2enc: NULL pointer dereference on charset conversion failure - debian/patches/CVE-2026-63686.patch: mod_xml2enc: NULL pointer dereference on charset conversion failure - CVE-2026-63686 * SECURITY UPDATE: mod_auth_digest: digest authentication replay - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: digest authentication replay - CVE-2026-73636 * SECURITY UPDATE: mod_auth_digest: use-after-free of client entry - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: use-after-free of client entry - CVE-2026-73637
CVEs fixed:
Updated packages:
  • apache2_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:bed08250dfd909ebd84906621380d7d18a1c5cbd
  • apache2-bin_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:7b5065a3950ee11e7b06de63fd2a188b43f4c870
  • apache2-data_2.4.67-1~deb11u3+tuxcare.els1_all.deb
    sha:7197dc09a85e336f84cfb803d75e41370d173c1a
  • apache2-dev_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:f8d053deda8ecd26d1d5bbab171a8f694daa7e80
  • apache2-doc_2.4.67-1~deb11u3+tuxcare.els1_all.deb
    sha:1b0e3cec9815efc638bad5ca6b3fe132d86ba740
  • apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:1d835ad5ced7f11d9d1c48ec120b209e821fb1bb
  • apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:d5efbddb5a947f6c31e220a1410cf0b140aed171
  • apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:08507e2d29ae73d640b00a5342469382de244286
  • apache2-utils_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:a3d5ae270f5df54ef5ec8ab1420d60a0ecffd656
  • libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:080b0cab9aa054bb3b312358e001d2e24e81d802
  • libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb
    sha:b36a83f4f296e292cf09ce8e677ac36231906b45
  • apache2_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:f9d991bc43b225527c1f7200770d20c2bcc4899b
  • apache2-bin_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:00e488be7604420e960cf3a230fe1dbb658e34ee
  • apache2-dev_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:ed7aec188ef2c79fbd96740b9ad61f2ec0768c09
  • apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:ab10a472f19029c7f7202cf882c2abb46c26a295
  • apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:7f982774fe7960b8500b27bd839616e4947828bf
  • apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:9652b86e8e0ee9b4e395126a59b1a2d7cb3eb7c6
  • apache2-utils_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:5a3b40c251f4173aee23d55eb27e0ada8b0720ba
  • libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:66a77336df3264db7a599a3073905204c3a527a8
  • libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb
    sha:27f661127af82eb3b1bfc10d5f080d4657cec969
  • apache2_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:0f568f640431a8fa5b4e9179e0143784d7273ace
  • apache2-bin_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:becb8f0e13dbe6c0e31c82a5a1932ce0f7228698
  • apache2-dev_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:6f266e8d27def8becf60a1dc65bea9232c9922ab
  • apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:b1c59920341b8a3060f96059b00895606f7e3549
  • apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:8c662e8626a327cf7f38aea340ceb00a5eafa23d
  • apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:b61bb9b741fcefceb83fa4ed9a0f2ea8c7fb2b79
  • apache2-utils_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:0db70b3ec09b8a8352183cfe8f0062259c8709df
  • libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:9f417cd9d671d995318d13b2ca8b56455cbe49a6
  • libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els1_armel.deb
    sha:b1be10c69a3c13d8ab94059ccabade3e7bd58074
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.