Release date:
2026-05-21 15:37:45 UTC
Description:
- CVE-2026-28780: mod_proxy_ajp 4-byte heap buffer overflow when contacting a malicious AJP backend (off-by-AJP_HEADER_LEN check in ajp_msg_check_header)
- CVE-2026-34059: mod_proxy_ajp heap over-read in ajp_parse_data on short AJP replies
- CVE-2026-33006: mod_auth_digest used non-constant-time strcmp() for nonce-hash and response-digest comparisons; replace with constant-time comparison and validate nonce/digest sizes
- CVE-2026-33857: mod_proxy_ajp off-by-one out-of-bounds reads in ajp_msg_get_uint8/uint16/uint32 and ajp_msg_peek_uint8/uint16 length checks
- CVE-2026-34032: mod_proxy_ajp ajp_msg_get_string: tighten length check to msg->len and verify the NUL terminator is present
Updated packages:
-
httpd-2.2.15-72.el6.tuxcare.els12.x86_64.rpm
sha:25a78ac248cea5a8b9cfac5a94a2b377f2a4963afdfd2eca307cea5eb6721b64
-
httpd-devel-2.2.15-72.el6.tuxcare.els12.i686.rpm
sha:dc7cd2f118a50f4be63d44cbd0be8d16e763ce23d11d90dca6c12a1f65a5cd1e
-
httpd-devel-2.2.15-72.el6.tuxcare.els12.x86_64.rpm
sha:0d4633684704cff4ee5aa432084625fcddd020d7eca385e3f122278ba0f8a4af
-
httpd-manual-2.2.15-72.el6.tuxcare.els12.noarch.rpm
sha:256fde12be9c63ab796aeb4b7b182f9858fbd6ba4cd3fb1a2c5db910401ce933
-
httpd-tools-2.2.15-72.el6.tuxcare.els12.x86_64.rpm
sha:fe76624c7a89b8e4ce07a35bf1cdf433a1cf77a5be70acba7bdfa7271893db1c
-
mod_ssl-2.2.15-72.el6.tuxcare.els12.x86_64.rpm
sha:f1aadc8002592a294a1c0cb3dd7c209921c983a6aff1a2f0f64f607427bb0817
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
