CLSA-2026-1786093474
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786093474
- Upstream
- Published
- 2026-08-07T09:04:47Z
- Modified
- 2026-10-26T09:43:40Z
- Summary
- Fix of 6 CVEs
- Details
-
- SECURITY UPDATE: potential SSRF in mod_rewrite via RewriteRule
substitutions that produce a scheme-like target
- debian/patches/CVE-2024-39573.patch: add the previously stripped per-directory prefix, or an implicit '/' root prefix, to the substituted URI before the query args are split in apply_rewrite_rule() in modules/mappers/mod_rewrite.c; otherwise a rule such as "RewriteRule ^/some/path(.*) $1" turns "/some/pathscheme:..." into the fully qualified URL "scheme:...", which mod_proxy then handles. Upstream fix 93aec0e3ca451bcc97f6d91c14d5399d13a73365 (SVN r1918600).
- CVE-2024-39573
- SECURITY UPDATE: insufficient escaping of mod_ssl variables written to
the log by CustomLog
- debian/patches/CVE-2024-47252.patch: pass the results of ssl_var_log_handler_c() and ssl_var_log_handler_x() through ap_escape_logitem() in modules/ssl/ssl_engine_vars.c, so an untrusted TLS client can no longer insert escape characters into log files through the %{varname}c and %{varname}x formats logging mod_ssl variables such as SSL_TLS_SNI. Upstream fix c01e60707048be14a510f0a92128a5227923215c (SVN r1927042).
- CVE-2024-47252
- SECURITY UPDATE: access control bypass by trusted clients through TLS
1.3 session resumption in mod_ssl
- debian/patches/CVE-2025-23048.patch: move the ssl_server_compatible() check in ssl_hook_ReadReq() in modules/ssl/ssl_engine_kernel.c out of the SNI-present branch, so the handshake virtual host and the request virtual host are compared even when the client sent no SNI, as happens on a resumed TLS 1.3 session; previously such a request could reach a virtual host with different client certificate restrictions when SSLStrictSNIVHostCheck was off. Upstream fix c4cfa50c9068e8b8134c530ab21674e77d1278a2 (SVN r1927043).
- CVE-2025-23048
- SECURITY UPDATE: denial of service through an assertion failure in
mod_proxy_http2
- debian/patches/CVE-2025-49630.patch: fall back to the server hostname when ProxyPreserveHost is on but the incoming request carried no Host: header, in open_stream() in modules/http2/h2_proxy_session.c, instead of passing a NULL authority on to the HTTP/2 backend and tripping an assertion. Upstream fix 88304321841a2fe8bd5eacc70e69418b0b545ca5 (SVN r1927044).
- CVE-2025-49630
- SECURITY UPDATE: query string passed by mod_cgid to Server Side Includes
#exec cmd= commands
- debian/patches/CVE-2025-58098.patch: pass NULL instead of r->args to create_argv() for SSI_REQ requests in cgid_server(), and tolerate a NULL args in create_argv(), in modules/generators/mod_cgid.c; otherwise the shell-escaped query string is appended as arguments to the command line of an SSI "#exec cmd=..." directive. Upstream fix ecc1b8f3817e3dcab9c1f24f905752d3c0a279af (SVN r1930161).
- CVE-2025-58098
- SECURITY UPDATE: integer overflow in the mod_md ACME renewal backoff
timer
- debian/patches/CVE-2025-55753.patch: double the retry delay step by step with an overflow and cap check in md_job_delay_on_errors() in modules/md/md_status.c instead of shifting job->min_delay left by err_count-1 in one go; otherwise after roughly 30 days of consecutive renewal failures the shift wraps the signed apr_time_t, the backoff collapses to 0 and the server retries against the ACME CA in a tight loop. Upstream fix 20666cfb765b8ad14efa3d97bc92d344b9395c89 (SVN r1929515).
- CVE-2025-55753
- SECURITY UPDATE: potential SSRF in mod_rewrite via RewriteRule
substitutions that produce a scheme-like target
- References
-
- https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786093474.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-39573
- https://nvd.nist.gov/vuln/detail/CVE-2024-47252
- https://nvd.nist.gov/vuln/detail/CVE-2025-23048
- https://nvd.nist.gov/vuln/detail/CVE-2025-49630
- https://nvd.nist.gov/vuln/detail/CVE-2025-55753
- https://nvd.nist.gov/vuln/detail/CVE-2025-58098