{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: mod_charset_lite: heap overflow in finish_partial_char\n - debian/patches/CVE-2026-56153.patch: mod_charset_lite: heap overflow in finish_partial_char\n - CVE-2026-56153\n * SECURITY UPDATE: mod_heartmonitor: NULL pointer dereference on malformed heartbeat\n - debian/patches/CVE-2026-46729.patch: mod_heartmonitor: NULL pointer dereference on malformed heartbeat\n - CVE-2026-46729\n * SECURITY UPDATE: mod_rewrite: use-after-free via LA-U lookahead variables\n - debian/patches/CVE-2026-56154.patch: mod_rewrite: use-after-free via LA-U lookahead variables\n - CVE-2026-56154\n * SECURITY UPDATE: mod_proxy_html: out-of-bounds write in dump_content\n - debian/patches/CVE-2026-56449.patch: mod_proxy_html: out-of-bounds write in dump_content\n - CVE-2026-56449\n * SECURITY UPDATE: mod_vhost_alias: stack overflow with oversized Host header\n - debian/patches/CVE-2026-63292.patch: mod_vhost_alias: stack overflow with oversized Host header\n - CVE-2026-63292\n * SECURITY UPDATE: mod_proxy_uwsgi: response smuggling via Transfer-Encoding\n - debian/patches/CVE-2026-63718.patch: mod_proxy_uwsgi: response smuggling via Transfer-Encoding\n - CVE-2026-63718\n * SECURITY UPDATE: mod_http2: use-after-free via shared session bbtmp re-entrancy\n - debian/patches/CVE-2026-57941.patch: mod_http2: use-after-free via shared session bbtmp re-entrancy\n - CVE-2026-57941\n * SECURITY UPDATE: mod_xml2enc: NULL pointer dereference on charset conversion failure\n - debian/patches/CVE-2026-63686.patch: mod_xml2enc: NULL pointer dereference on charset conversion failure\n - CVE-2026-63686\n * SECURITY UPDATE: mod_auth_digest: digest authentication replay\n - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: digest authentication replay\n - CVE-2026-73636\n * SECURITY UPDATE: mod_auth_digest: use-after-free of client entry\n - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: use-after-free of client entry\n - CVE-2026-73637", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1792508142.json" } ], "tracking": { "current_release_date": "2026-10-20T14:57:49Z", "generator": { "date": "2026-10-20T14:57:49Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792508142", "initial_release_date": "2026-10-20T14:57:49Z", "revision_history": [ { "date": "2026-10-20T14:57:49Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix of 10 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 11", "product": { "name": "Debian 11", "product_id": "Debian-11", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-utils@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libapache2-mod-md@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-bin@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-dev@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-suexec-custom@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-ssl-dev@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libapache2-mod-proxy-uwsgi@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product": { "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_id": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-suexec-pristine@2.4.67-1~deb11u3%2Btuxcare.els1?arch=armel" } } } ], "category": "architecture", "name": "armel" }, { "branches": [ { "category": "product_version", "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-utils@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libapache2-mod-md@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-bin@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-dev@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-suexec-custom@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-ssl-dev@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libapache2-mod-proxy-uwsgi@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product": { "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_id": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-suexec-pristine@2.4.67-1~deb11u3%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-utils@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libapache2-mod-md@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-bin@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-dev@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-suexec-custom@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-ssl-dev@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libapache2-mod-proxy-uwsgi@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product": { "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_id": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-suexec-pristine@2.4.67-1~deb11u3%2Btuxcare.els1?arch=arm64" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "product": { "name": "apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "product_id": "apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-doc@2.4.67-1~deb11u3%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "product": { "name": "apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "product_id": "apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/apache2-data@2.4.67-1~deb11u3%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all" }, "product_reference": "apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel" }, "product_reference": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64" }, "product_reference": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64" }, "product_reference": "apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all" }, "product_reference": "apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-57941", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-57941" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/19", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/19" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-56154", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...})\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-56154" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/17", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/17" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-63292", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63292" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/24", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/24" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-73636", "cwe": { "id": "CWE-294", "name": "Authentication Bypass by Capture-replay" }, "notes": [ { "category": "description", "text": "Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-73636" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/27", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/27" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-73637", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-73637" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/28", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/28" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-63718", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" }, "notes": [ { "category": "description", "text": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63718" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/26", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/26" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-63686", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63686" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/25", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/25" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-56449", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-56449" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/18", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/18" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-56153", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-56153" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/16", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/16" } ], "release_date": "2026-10-01T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-46729", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46729" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/01/13", "url": "http://www.openwall.com/lists/oss-security/2026/10/01/13" } ], "release_date": "2026-10-01T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T14:55:43.757389Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142", "product_ids": [ "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-bin-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-data-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-doc-0:2.4.67-1~deb11u3+tuxcare.els1.all", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-ssl-dev-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-custom-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-suexec-pristine-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:apache2-utils-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-md-0:2.4.67-1~deb11u3+tuxcare.els1.armel", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.amd64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.arm64", "Debian-11:libapache2-mod-proxy-uwsgi-0:2.4.67-1~deb11u3+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792508142" } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }