CLSA-2026-1782293598
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782293598
- Upstream
- Published
- 2026-06-24T09:33:40Z
- Modified
- 2026-10-26T09:32:01Z
- Summary
- Fix CVE(s): CVE-2026-44119, CVE-2026-44185, CVE-2026-44186, CVE-2026-44631
- Details
-
- SECURITY UPDATE: mod_proxy_ftp infinite loop in Retry-After parsing
- debian/patches/CVE-2026-44186.patch: advance secs_str in the digit-scan loop in modules/proxy/mod_proxy_ftp.c.
- CVE-2026-44186
- SECURITY UPDATE: mod_ssl OCSP request corruption on short socket write
- debian/patches/CVE-2026-44185.patch: advance the write buffer by the bytes actually sent (wlen) in modules/ssl/ssl_util_ocsp.c.
- CVE-2026-44185
- SECURITY UPDATE: ap_regname unbounded capture-group allocation (DoS)
- debian/patches/CVE-2026-44631.patch: read capture index bytes as unsigned and reject captures > 1024 in server/util_pcre.c, and treat a negative ap_regname() return as an error in server/core.c and modules/proxy/mod_proxy.c.
- CVE-2026-44631
- SECURITY UPDATE: ap_expr file functions exposable from .htaccess
- debian/patches/CVE-2026-44119.patch: restrict file functions/tests centrally in ap_expr_parse_cmd_mi() via a new AP_EXPR_FLAG_RESTRICTED_FILE_FUNC flag in include/ap_expr.h and server/util_expr_eval.c, dropping the per-module restriction in modules/mappers/mod_rewrite.c and modules/metadata/mod_setenvif.c.
- CVE-2026-44119
- SECURITY UPDATE: mod_proxy_ftp infinite loop in Retry-After parsing
- References