[CLSA-2026:1791538487] httpd: Fix of 17 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-09 09:35:12 UTC
Description:
- CVE-2026-58415: mod_dav_fs: deny every request for the .DAV state directory from a fixup hook, so the default handler can no longer serve the lock and property databases to GET requests (information disclosure) - CVE-2026-59797: mod_ssl: restrict the file() and filesize() functions in SSLRequire expressions read from .htaccess files (improper privilege management) - CVE-2026-63045: mod_proxy_ftp: reject a PASV reply whose address differs from the FTP server of the control connection (FTP bounce) - CVE-2026-79768: mod_userdir: fix the check rejecting "." and ".." as user names, which tested the wrong characters (information disclosure) - CVE-2026-42356: do not pass the trusted content type of a request on to its internal redirect in ap_internal_redirect_handler(), so the redirect target is not run as CGI (limited remote code execution)
CVEs fixed:
Updated packages:
  • httpd-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:2f955a92800240bb63370d4084593c5021bd34c367d700ff1518f19f558d4399
  • httpd-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:f2431d6063d032345615604524db45e0170cf064448b0539bb871bf86bd66762
  • httpd-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:d2bb42b8789cb0c64ac6d22242973f5c2d20768f6df4f03f6ee8b98dd787ae60
  • httpd-core-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:6e397c836f329c56f1a653a9da3ddf5c0238cc00ed9be8319d34e1ce346e2e87
  • httpd-core-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:f39e9e2f10672aacc8b43c15c0426596a85e5f68cfc91be964dd0fa797f855e9
  • httpd-core-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:27cbe466c8f7e1683ffa7d67b345b321b24266fb3e9deeb1a4f249ba0ab728dc
  • httpd-devel-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:93bbc919e47283c3b8ddfda19478a6cf00fc2d11f81f364a0a3444e9487cb468
  • httpd-devel-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:c26594fbee0c53e17c2ca2a6debc0ae9f5533ba90b185aa501efa25cd29017fb
  • httpd-devel-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:0d25ef24a94457ea4ba81916f6a22d36368ef92ab98255e34a89a7280b9e98e0
  • httpd-filesystem-2.4.53-11.el9_2.5.tuxcare.els25.noarch.rpm
    sha:61e0dd81656d2e18a650fff8cf9fa4cf3811e2df9d4586ada6257388fdc204ed
  • httpd-manual-2.4.53-11.el9_2.5.tuxcare.els25.noarch.rpm
    sha:78f359ee5ba6822fa372b512426ce3ee10a8d213f847d8eadcf77709ec95a44f
  • httpd-tools-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:e087dcd17b9e16b75dfc896c863f540340dbf5e241be2391cc528992f68d2960
  • httpd-tools-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:b8827d045c9df2601ea9f812fea72121fb9b82e8c9f02ed891784fd4c61717fd
  • httpd-tools-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:4efe1ac6650fc41d0365d17a6361d8d7f271139b69bc2481dbba6e51f3f2c77f
  • mod_ldap-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:bf76b6f002c6e0db4f2d50132cc0cde3d7050f6832d9cdec16e165c93b83e4ce
  • mod_ldap-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:169036e8f5a5eeec2be94acf25da8f8685183bfa7289fb01f10b4141d06bf67a
  • mod_ldap-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:0a786e23df0699be649c8872b9cb8a8a5212821f151131b7edd5fdac144294e6
  • mod_lua-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:73cd171c2a26f8e521d36c6441400ea5f7956c6a5974d81df04a0c88edc228fe
  • mod_lua-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:8670933f7dcf18d095cc3497386721f2952eb54d41b5e69f4a5f40338ed2f5c6
  • mod_lua-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:b1505637222e8e15fdce30d2629f73754a441b2915c56539c5143225edac375b
  • mod_proxy_html-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:78569e1b6373d3bf8aedfac3f4cab3d2bfc0a34406ee6b0ada4a0dc4c602a3c7
  • mod_proxy_html-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:57bf8fc9604634ffe2ce81617ad5c012b14f1bb6fcb14ea7f17dc3047966b43d
  • mod_proxy_html-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:9118a144d345cb1a102a975c01382e701bfb9001f110da7e0925a343affa78e9
  • mod_session-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:1ffc09123feb53e609f7cbf0653189210df319f39b1dec341e2160541088b43e
  • mod_session-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:82251466f270678167de6c94e545cc5527842738d96b25c11ad07305d47a9295
  • mod_session-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:a403f578a6c60dc5317dca994e2e4f808be56cb04b7db6200f495148a4bba7a4
  • mod_ssl-2.4.53-11.el9_2.5.tuxcare.els25.aarch64.rpm
    sha:06f9728b7dabf2d5bbb0e28acc68d333a5fbc372afea42dde85a3c49d18c7471
  • mod_ssl-2.4.53-11.el9_2.5.tuxcare.els25.i686.rpm
    sha:759833a6a0d4f141565d1f1f7a850cbde488926533d015d8d2bc2abbe2034f6b
  • mod_ssl-2.4.53-11.el9_2.5.tuxcare.els25.x86_64.rpm
    sha:61b4ca88781d9e7e8a86c84a80fd8bbb643a29c742779e3e1a69fd53260a7837
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.