Release date:
2026-10-07 19:38:44 UTC
Description:
* SECURITY UPDATE: use-after-free of lookahead Vary value in mod_rewrite
- debian/patches/CVE-2026-56154.patch: copy the Vary header name into
r->pool before destroying the LA-U/LA-F lookahead sub-request in
lookup_variable() in modules/mappers/mod_rewrite.c.
- CVE-2026-56154
* SECURITY UPDATE: stack buffer overflow in mod_vhost_alias interpolation
- debian/patches/CVE-2026-63292.patch: reject a VirtualDocumentRoot
segment that does not fit the HUGE_STRING_LEN buffer with HTTP 414
in vhost_alias_checkspace() in modules/mappers/mod_vhost_alias.c.
- CVE-2026-63292
* SECURITY UPDATE: mishandled incomplete input in mod_xml2enc
- debian/patches/CVE-2026-63686.patch: handle APR_INCOMPLETE from the
converter and pass unconverted input raw instead of looping on a
NULL converter in xml2enc_ffunc() in modules/filters/mod_xml2enc.c.
- CVE-2026-63686
Updated packages:
-
apache2_2.4.18-2ubuntu3.17+tuxcare.els26_amd64.deb
sha:272643cbfc4449ace0c3b7073ed18177da066bf9
-
apache2-bin_2.4.18-2ubuntu3.17+tuxcare.els26_amd64.deb
sha:f1ba021cf1d23884f279821107b710c8d7ce2542
-
apache2-data_2.4.18-2ubuntu3.17+tuxcare.els26_all.deb
sha:a13965e82f4068538a6eb1306ae75375dd5213c0
-
apache2-dev_2.4.18-2ubuntu3.17+tuxcare.els26_amd64.deb
sha:5086324033663188fd37f54f49e49f398ea48d8f
-
apache2-doc_2.4.18-2ubuntu3.17+tuxcare.els26_all.deb
sha:1f739ed4575e094f26b3a6677fbde1183586ecaa
-
apache2-suexec-custom_2.4.18-2ubuntu3.17+tuxcare.els26_amd64.deb
sha:fcf61177f9916807cd164772e822d8da9780576f
-
apache2-suexec-pristine_2.4.18-2ubuntu3.17+tuxcare.els26_amd64.deb
sha:7ba63b8c8be9124d69726d2f0175bf29d89c7d39
-
apache2-utils_2.4.18-2ubuntu3.17+tuxcare.els26_amd64.deb
sha:c38c234d126c6213b3920d65dc2594dff491b58c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
