CLSA-2026-1781273712
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781273712.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1781273712
- Upstream
CVE (3)
- CVE-2026-29167
- CVE-2026-34355
- CVE-2026-34356
- Published
- 2026-06-12T14:15:36Z
- Modified
- 2026-10-26T09:32:05Z
- Summary
- Fix CVE(s): CVE-2026-29167, CVE-2026-34355, CVE-2026-34356
- Details
-
- SECURITY UPDATE: use-after-free in mod_ldap per-directory client
certificate configuration
- debian/patches/CVE-2026-29167.patch: deep-copy the per-directory client_certs array (each cert path and password) into the connection pool in uldap_connection_find() so the cached connection no longer retains pointers into the short-lived per-directory config pool in modules/ldap/util_ldap.c.
- CVE-2026-29167
- SECURITY UPDATE: buffer overflow in mod_proxy_html with an untrusted
backend response
- debian/patches/CVE-2026-34355.patch: replace the hand-managed preserve()/pappend() output buffer with the bounds-checked ap_varbuf API (ap_varbuf_grow, ap_varbuf_strmemcat, ap_varbuf_regsub) for the CDATA, element and event URL rewrites so an oversized substitution can no longer overflow the buffer in modules/filters/mod_proxy_html.c.
- CVE-2026-34355
- SECURITY UPDATE: heap buffer overflow in mod_proxy ProxyPassReverseCookie
handling with a malicious backend response
- debian/patches/CVE-2026-34356.patch: reset newpath/pdiff and newdomain/ddiff for each path= and domain= cookie attribute in ap_proxy_cookie_reverse_map() so a duplicate attribute can no longer reuse a stale length offset and overflow the rewritten cookie buffer in modules/proxy/proxy_util.c.
- CVE-2026-34356
- SECURITY UPDATE: use-after-free in mod_ldap per-directory client
certificate configuration
- References