CLSA-2026-1786119141
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786119141
- Upstream
- Published
- 2026-08-13T02:39:13Z
- Modified
- 2026-10-26T09:43:32Z
- Summary
- Fix of 5 CVEs
- Details
-
- SECURITY UPDATE: stale custom cookie host causes cookie leak
- debian/patches/CVE-2026-6276.patch: clear the remembered custom Host: name at the start of every request in lib/http.c.
- CVE-2026-6276
- SECURITY UPDATE: wrong STARTTLS connection reuse
- debian/patches/CVE-2026-8286.patch: require a matching SSL configuration when reusing a connection for a transfer that may upgrade to TLS in lib/url.c.
- CVE-2026-8286
- SECURITY UPDATE: env-set cross-proxy Digest auth state leak
- debian/patches/CVE-2026-8927.patch: flush the proxy Digest state when the proxy read from the environment changes in lib/url.c, lib/urldata.h.
- CVE-2026-8927
- SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS
session cache
- debian/patches/CVE-2026-8932.patch: include the client private key options in the primary SSL config so connection reuse and the TLS session cache compare them in lib/url.c, lib/urldata.h, lib/vtls/vtls.c.
- CVE-2026-8932
- SECURITY UPDATE: HTTP/2 push headers memory leak
- debian/patches/CVE-2024-2398.patch: free the whole set of push headers on the array-growth failure path in lib/http2.c.
- CVE-2024-2398
- SECURITY UPDATE: stale custom cookie host causes cookie leak
- References
-
- https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786119141.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-2398
- https://nvd.nist.gov/vuln/detail/CVE-2026-6276
- https://nvd.nist.gov/vuln/detail/CVE-2026-8286
- https://nvd.nist.gov/vuln/detail/CVE-2026-8927
- https://nvd.nist.gov/vuln/detail/CVE-2026-8932