CLSA-2026-1786359337
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786359337
- Upstream
- Published
- 2026-08-10T10:55:54Z
- Modified
- 2026-10-26T09:43:33Z
- Summary
- Fix of 8 CVEs
- Details
-
- SECURITY UPDATE: HTTP/2 header limit errors deferred until whole header block read
- debian/patches/CVE-2024-24549.patch: validate headers after each HEADERS/CONTINUATION payload instead of only at end of block in java/org/apache/coyote/http2/Http2Parser.java, and swap the header emitter to the sink once validation fails in java/org/apache/coyote/http2/{Stream,Http2UpgradeHandler}.java
- CVE-2024-24549
- SECURITY UPDATE: HTTP/2 active stream miscount leading to infinite connection timeout
- debian/patches/CVE-2024-34750.patch: count each stream out of the active set exactly once in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler,Stream}.java
- CVE-2024-34750
- SECURITY UPDATE: RCE via TOCTOU race in write-enabled default servlet on case insensitive file systems
- debian/patches/CVE-2024-50379.patch: add path-keyed read/write locking via the new java/org/apache/catalina/WebResourceLockSet.java and use it in java/org/apache/catalina/webresources/{DirResourceSet,FileResource}.java
- CVE-2024-50379
- SECURITY UPDATE: incomplete mitigation for CVE-2024-50379 on Java 8 and Java 11
- debian/patches/CVE-2024-56337.patch: set -Dsun.io.useCanonCaches=false before any file system access in bin/catalina.sh
- CVE-2024-56337
- SECURITY UPDATE: authentication bypass when a Jakarta Authentication component throws
- debian/patches/CVE-2024-52316.patch: set a 500 status when validateRequest() throws AuthException in java/org/apache/catalina/authenticator/AuthenticatorBase.java
- CVE-2024-52316
- SECURITY UPDATE: HTTP/2 denial of service via client triggered server side stream resets
- debian/patches/CVE-2025-48989.patch: charge server initiated resets to the overhead counter in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler}.java
- CVE-2025-48989
- SECURITY UPDATE: directory traversal via Rewrite Valve normalizing before decoding
- debian/patches/CVE-2025-55752.patch: decode the rewritten URL before normalizing it in java/org/apache/catalina/valves/rewrite/RewriteValve.java
- CVE-2025-55752
- SECURITY UPDATE: EncryptInterceptor padding oracle from the CBC default
- debian/patches/CVE-2026-29146.patch: reject cipher modes that provide no protection and warn on the weaker ones in java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java; AES/GCM/PKCS5Padding, AES/CBC/NoPadding, AES/CFB/NoPadding and AES/OFB/NoPadding are now refused at startup
- CVE-2026-29146
- SECURITY UPDATE: HTTP/2 header limit errors deferred until whole header block read
- References
-
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1786359337.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-24549
- https://nvd.nist.gov/vuln/detail/CVE-2024-34750
- https://nvd.nist.gov/vuln/detail/CVE-2024-50379
- https://nvd.nist.gov/vuln/detail/CVE-2024-52316
- https://nvd.nist.gov/vuln/detail/CVE-2024-56337
- https://nvd.nist.gov/vuln/detail/CVE-2025-48989
- https://nvd.nist.gov/vuln/detail/CVE-2025-55752
- https://nvd.nist.gov/vuln/detail/CVE-2026-29146