Release date:
2026-10-02 20:22:48 UTC
Description:
- CVE-2026-55677: stop unescaping the static file wildcard by default in
Static, StaticFS, Group.StaticFS and StaticWithConfig of the vendored
github.com/labstack/echo/v4 (the echo v4.15.4 fix), so an encoded
separator (%2F, %5C) or dot-segment (%2E%2E) cannot resolve a static
file outside the route the router matched and bypass route-level
middleware; unescaping is opt-in via EnablePathUnescapingStaticFiles
and StaticConfig.EnablePathUnescaping
Updated packages:
-
osbuild-composer-76-2.el9_2.2.alma.tuxcare.els12.aarch64.rpm
sha:d7f28b090002992d9e9bb0ad7f2f5d46a597e1227bc7cb653682df468d74273e
-
osbuild-composer-76-2.el9_2.2.alma.tuxcare.els12.x86_64.rpm
sha:f6bcd23d38e9f6ca27f04023c584e6cea82c1587d06f521f730b2d0f7bcaccc0
-
osbuild-composer-core-76-2.el9_2.2.alma.tuxcare.els12.aarch64.rpm
sha:83f64ba4eb8aba3c44f4fe177082d6d13dd9f4daf9248620e2cb94e2416f524c
-
osbuild-composer-core-76-2.el9_2.2.alma.tuxcare.els12.x86_64.rpm
sha:a211801e4ada959c63f55205bd1c2992b4564fbda173db15da9d0fff9ca8a0bd
-
osbuild-composer-dnf-json-76-2.el9_2.2.alma.tuxcare.els12.aarch64.rpm
sha:200f1f37c694e8f28218a71818f8bc73babe505ecdbc0a60f9854781823ce924
-
osbuild-composer-dnf-json-76-2.el9_2.2.alma.tuxcare.els12.x86_64.rpm
sha:9d66675ed5470df777cb3939672df4dc28749ea38a0736bb9adb4ce879b90687
-
osbuild-composer-tests-76-2.el9_2.2.alma.tuxcare.els12.aarch64.rpm
sha:6480a90c5d35b51b17601d3ec67fc9ee529a872372152be50296f88fae70056e
-
osbuild-composer-tests-76-2.el9_2.2.alma.tuxcare.els12.x86_64.rpm
sha:020d7d55e418c047847791257a774c72eba1701828bcf51750c919c9f183310f
-
osbuild-composer-worker-76-2.el9_2.2.alma.tuxcare.els12.aarch64.rpm
sha:73a5d84cc0b670ade57566e337bf72c7b65907db05940ad0fed7c3d0a515f09b
-
osbuild-composer-worker-76-2.el9_2.2.alma.tuxcare.els12.x86_64.rpm
sha:5363f7ca26ea0681329c3af67de4258be6e2ff2a07b1e3b23a07e8b1bfaba6ee
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
