CLSA-2026-1778934210
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778934210.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1778934210
- Upstream
- Published
- 2026-05-16T14:38:58Z
- Modified
- 2026-06-04T10:03:43.834126642Z
- Summary
- Fix of 7 CVEs
- Details
-
- SECURITY UPDATE: off-by-one OOB read in modproxyajp message getters
- debian/patches/CVE-2026-33857.patch: tighten length checks
(
> msg->len->>= msg->len) in ajpmsggetuint8/16/32 and ajpmsgpeekuint8/16 in modules/proxy/ajp_msg.c. - CVE-2026-33857
- debian/patches/CVE-2026-33857.patch: tighten length checks
(
- SECURITY UPDATE: heap over-read in modproxyajp via missing
null-termination check in ajpmsggetstring()
- debian/patches/CVE-2026-34032.patch: switch the buffer overflow check to compare against msg->len and verify the expected null terminator is present before returning the pointer in modules/proxy/ajp
- CVE-2026-34032
- SECURITY UPDATE: heap over-read and memory disclosure in modproxyajp ajpparsedata() via missing minimum message-length validation
- debian/patches/CVE-2026-34059.patch: reject AJP data messages
whose
msg->lenis smaller than AJPHEADERLEN + AJPHEADERSZLEN + 1 + 1 before computing expectedlen in modules/proxy/ajp_header.c. - CVE-2026-34059
- SECURITY UPDATE: local information disclosure via .htaccess / mod_setenvif / ProxyFCGISetEnvIf, where a non-privileged user with .htaccess write access could read files accessible to the httpd service account
- debian/patches/CVE-2026-24072.patch: pass APEXPRFLAGRESTRICTED when parsing apexpr expressions from htaccess context in modules/mappers/modrewrite.c, modules/metadata/modsetenvif.c, and modules/proxy/modproxyfcgi.c.
- CVE-2026-24072
- SECURITY UPDATE: timing attack against modauthdigest allowing bypass of Digest authentication
- debian/patches/CVE-2026-33006.patch: validate nonce and digest lengths earlier and replace the strcmp of the nonce hash with the constant-time aprcryptoequals (apr-util >= 1.6) in modules/aaa/modauthdigest.c; bump APU minimum to 1.6 in configure.in.
- CVE-2026-33006
- SECURITY UPDATE: NULL pointer dereference in modauthnsocache crashes the child process in a caching forward proxy setup
- debian/patches/CVE-2026-33007.patch: validate the URL before using the cache hash in constructkey() in modules/aaa/modauthn_socache.c.
- CVE-2026-33007
- SECURITY UPDATE: HTTP response splitting via newline/control characters in an outgoing status line forwarded from a compromised backend
- debian/patches/CVE-2026-33523.patch: reject status reason strings that contain newlines or control characters in modules/http/http_filters.c.
- CVE-2026-33523
- SECURITY UPDATE: off-by-one OOB read in modproxyajp message getters
- References