[CLSA-2026:1791970059] Fix CVE(s): CVE-2026-44185, CVE-2026-46729
Type:
security
Severity:
Important
Release date:
2026-10-14 09:27:50 UTC
Description:
* SECURITY UPDATE: buffer over-read in mod_ssl OCSP requests - debian/patches/CVE-2026-44185.patch: in send_request() in modules/ssl/ssl_util_ocsp.c, advance the write pointer by the number of bytes actually sent instead of the total remaining length so a short write to an attacker controlled OCSP responder can no longer read past the end of the stack buffer. Backported from httpd commit 32b7e2e66477020ba75b78ab43fb8890ec292ad2 (SVN r1934919). - CVE-2026-44185 * SECURITY UPDATE: NULL pointer dereference in mod_heartmonitor - debian/patches/CVE-2026-46729.patch: in hm_handler() in modules/cluster/mod_heartmonitor.c, reject requests when the module is not active or the body exceeds MAX_MSG_LEN, require the busy and ready parameters, and parse port, busy and ready with strtol() so a crafted unicast heartbeat can no longer dereference a NULL pointer. Backported from httpd commit 7b12a7936ec439b3e1f5fc36cfacf5b915eb652c (SVN r1938654). - CVE-2026-46729
CVEs fixed:
Updated packages:
  • apache2_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:a787759257c886c33dcaf31dd5fb2a3ae59b9f03
  • apache2-bin_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:4158d35e0e2e5c9d09600a8123981ed2bb907ea5
  • apache2-data_2.4.41-4ubuntu3.23+tuxcare.els16_all.deb
    sha:0233d24e785bd819cf0ecf60990326932b0de50c
  • apache2-dev_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:0785588a27f68ca7fc7902defdf42d152b0da6e3
  • apache2-doc_2.4.41-4ubuntu3.23+tuxcare.els16_all.deb
    sha:406cb4065f757ffc6c03e40a825e01db8717d5d7
  • apache2-ssl-dev_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:d3d9e1990c772f04ae9790eda806e2338e02c3e1
  • apache2-suexec-custom_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:b2cded989821e31287e3c1e719349296aa6184c3
  • apache2-suexec-pristine_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:2e0f0bed42181f47a81dcf73b0ece7db2b428f44
  • apache2-utils_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:af51493c40a67d46a3221f96158df1e7717ea7ed
  • libapache2-mod-md_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:950509a35011bfd1b05f08fdd5dbd6fd0e1bff60
  • libapache2-mod-proxy-uwsgi_2.4.41-4ubuntu3.23+tuxcare.els16_amd64.deb
    sha:c2a19c786c49772bd054f38d080f88417d5589d8
  • apache2_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:9167f75f2b467857906f99d62da7eb3b12173c1a
  • apache2-bin_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:c4a1de5cc4493660ea07e177d2daa365a65eb228
  • apache2-dev_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:d8c63436d9b77ac2b9e4681482304315aaf217e0
  • apache2-ssl-dev_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:6ef699a2023189c16e2166eb9674cd89ca8e3769
  • apache2-suexec-custom_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:e02fa37be983ace2cd8b620f1e58179dad993ec1
  • apache2-suexec-pristine_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:54fc7eff117ed4bc8d9a788e4788a2c7cce9da7f
  • apache2-utils_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:ce774105632cb12d5c70bbca608de081918abe88
  • libapache2-mod-md_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:3389f27dcae7c24a8cd0054e6b7df91987707614
  • libapache2-mod-proxy-uwsgi_2.4.41-4ubuntu3.23+tuxcare.els16_arm64.deb
    sha:4a53d310d3dc48afc7fb0df676f08dcd6f84cd1c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.