Release date:
2026-10-09 16:45:46 UTC
Description:
* SECURITY UPDATE: use-after-free in mod_http2 via shared session->bbtmp
- debian/patches/CVE-2026-57941.patch: use a per-call brigade instead
of the shared session->bbtmp in on_send_data_cb() and
ev_stream_closed(), and skip streams already in cleanup state in
rst_unprocessed_stream() and on_stream_close_cb() in
modules/http2/h2_session.c.
- CVE-2026-57941
Updated packages:
-
apache2_2.4.29-1ubuntu4.27+tuxcare.els18_amd64.deb
sha:f173d1efdbb66180604a77dfd430c508d763abf9
-
apache2-bin_2.4.29-1ubuntu4.27+tuxcare.els18_amd64.deb
sha:fb8e4b6ce6d942da536af2581c843c285097db65
-
apache2-data_2.4.29-1ubuntu4.27+tuxcare.els18_all.deb
sha:e9e71a988efbf6ddd1ca7d39a4f4a73d2ab7657c
-
apache2-dev_2.4.29-1ubuntu4.27+tuxcare.els18_amd64.deb
sha:1ca4e07051faf64d82d1b2f5408d096e7e7986c7
-
apache2-doc_2.4.29-1ubuntu4.27+tuxcare.els18_all.deb
sha:c7f622c90f6c462fb35bfe0aa8bbbbc6d74db38c
-
apache2-ssl-dev_2.4.29-1ubuntu4.27+tuxcare.els18_amd64.deb
sha:e8033887aa91bb35331d415f93f773f65d999c5d
-
apache2-suexec-custom_2.4.29-1ubuntu4.27+tuxcare.els18_amd64.deb
sha:909ca5dabff0c0b9903de261b0a98b89f23cd053
-
apache2-suexec-pristine_2.4.29-1ubuntu4.27+tuxcare.els18_amd64.deb
sha:66e748b62a9ef9b6c10685ab0f5c640a03a3c95b
-
apache2-utils_2.4.29-1ubuntu4.27+tuxcare.els18_amd64.deb
sha:84e3742fe304785d83c4debc0067bad7727341cc
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
