Release date:
2026-10-08 11:35:08 UTC
Description:
- CVE-2026-63718: fix mod_proxy_uwsgi response smuggling via hop-by-hop
headers from the backend
- CVE-2026-73636: fix mod_auth_digest one-time nonce replay
- CVE-2026-73637: fix mod_auth_digest use-after-free on concurrent requests
- CVE-2026-48005: fix mod_auth_digest forced re-authentication via forged
Authorization headers with AuthDigestNcCheck
- mod_auth_digest: configs using "AuthDigestQop none" or the "authdigest-opaque"
Mutex type no longer start (the shipped manual still documents
"AuthDigestQop none"); RFC 2069 clients (no qop) are refused; no
Authentication-Info on 401/407; 503, or 401 without a challenge, if no
client entry fits in shared memory; log ids AH01767, AH01771, AH01772,
AH01792 and AH01793 are removed
- mod_auth_digest: after a reload (graceful restart) a captured request is
accepted once more under AuthDigestNonceLifetime 0 or AuthDigestNcCheck;
only a full restart invalidates it (fixed upstream only in trunk
f4c4160fbf, not in 2.4.69)
Updated packages:
-
httpd-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.i686.rpm
sha:0cea7ba9b78cea48e94fdf0fb13cef0c48c4e08887b9abbbafbaf4ccc5e80514
-
httpd-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.x86_64.rpm
sha:ecda99f013ea02ac0550a13e7f9787f977118885a2c95eb8ab7303a48176d62c
-
httpd-devel-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.i686.rpm
sha:97b9b36d6b0cd2ed76370774b6aeedb85195e22e2d854ba1220779721cac921b
-
httpd-devel-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.x86_64.rpm
sha:84317c33d60ca2ba00e121206f40bbb01c4c0779c884131c8002b08d3b388d5e
-
httpd-filesystem-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.noarch.rpm
sha:182e89ecc2a910653ac25bdf0e93761ca0ca208907594ebda1ea8874709de8b7
-
httpd-manual-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.noarch.rpm
sha:76b2c1236118e0ca6229c467f5fe49312c5728bee70e93cee891d94df6d84485
-
httpd-tools-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.i686.rpm
sha:39372cb71936aea65993c9a103bcb4745619a1123c2860e77ad88507f2adc350
-
httpd-tools-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.x86_64.rpm
sha:cb4278b132ff160a5fb234200780ab005e77587012055ab798b95b7218753992
-
mod_ldap-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.i686.rpm
sha:f68f4999d34282eb1e4a2b74d1396a9646a642c0315e89e2130827d3fc1ac389
-
mod_ldap-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.x86_64.rpm
sha:18ff1acc15aa8aa64dd859656ffb75718960bdfeff44bd4faa587bb1d3de74bf
-
mod_proxy_html-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.i686.rpm
sha:7e6503a282ed14cfc29cea5492213a8c576765f475e9fae0b4d26325cc656b28
-
mod_proxy_html-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.x86_64.rpm
sha:3d8330fb4864a98f24c232f962cd8a2667164818109356fdf0b039db44e58164
-
mod_session-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.i686.rpm
sha:bbc65f6a2ef17ebbfdeb0f6ce435ac292bb19aa84d07f7c87e4380cf34cd22b0
-
mod_session-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.x86_64.rpm
sha:e874e887e2526ccd1b8dc19f32f7d5694310ef8d310c962c3017b87318893462
-
mod_ssl-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.i686.rpm
sha:e670b0997c84bd11645a2e9374581410561b2098c9099ad6f2130626919319a8
-
mod_ssl-2.4.37-39.module_el8.4.0+2646+9aacdc29.1.tuxcare.els23.x86_64.rpm
sha:b2e0d19264e7a621ac6b42243b9cb0bd5f5c5a330663bbb5aaba974076fb1dab
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
