CLSA-2026-1779296292

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1779296292.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1779296292
Upstream
  • CVE-2026-33006
Published
2026-05-20T16:58:16Z
Modified
2026-06-01T00:33:26Z
Summary
httpd: Fix of 5 CVEs
Details
  • CVE-2026-28780: mod_proxy_ajp 4-byte heap buffer overflow when contacting a malicious AJP backend (off-by-AJP_HEADER_LEN check in ajp_msg_check_header)
  • CVE-2026-34059: mod_proxy_ajp heap over-read in ajp_parse_data on short AJP replies
  • CVE-2026-33006: mod_auth_digest used non-constant-time strcmp() for nonce-hash and response-digest comparisons; replace with constant-time comparison and validate nonce/digest sizes
  • CVE-2026-33857: mod_proxy_ajp off-by-one out-of-bounds reads in ajp_msg_get_uint8/uint16/uint32 and ajp_msg_peek_uint8/uint16 length checks
  • CVE-2026-34032: mod_proxy_ajp ajp_msg_get_string: tighten length check to msg->len and verify the NUL terminator is present
References

Affected packages

TuxCare:OracleLinux:6
httpd

Package

Name
httpd
Purl
pkg:rpm/tuxcare/httpd?distro=oraclelinux-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.15-72.el6.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1779296292.json"
httpd-devel

Package

Name
httpd-devel
Purl
pkg:rpm/tuxcare/httpd-devel?distro=oraclelinux-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.15-72.el6.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1779296292.json"
httpd-manual

Package

Name
httpd-manual
Purl
pkg:rpm/tuxcare/httpd-manual?distro=oraclelinux-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.15-72.el6.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1779296292.json"
httpd-tools

Package

Name
httpd-tools
Purl
pkg:rpm/tuxcare/httpd-tools?distro=oraclelinux-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.15-72.el6.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1779296292.json"
mod_ssl

Package

Name
mod_ssl
Purl
pkg:rpm/tuxcare/mod_ssl?distro=oraclelinux-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:2.2.15-72.el6.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1779296292.json"