CLSA-2026-1786543355
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786543355
- Upstream
- Published
- 2026-08-20T10:41:55Z
- Modified
- 2026-10-26T09:31:40Z
- Summary
- Fix of 7 CVEs
- Details
-
- SECURITY UPDATE: fix for the following CVEs:
- CVE-2025-48989: MadeYouReset HTTP/2 DoS — charge the connection overhead budget for server-initiated RST_STREAM frames in both Http2UpgradeHandler and Http2AsyncUpgradeHandler, and apply the initial HTTP/2 MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE limits immediately (force-set) rather than only after the client ACKs the SETTINGS frame, closing the "malformed control frame -> server RST" amplification loop.
- CVE-2025-55752: RewriteValve query-string-append (QSA) path traversal — swap the normalize/decode order in RewriteValve.invoke() so the rewritten URL is URL-decoded before normalisation, preventing encoded traversal sequences such as %2F..%2F from surviving normalize() and later reaching /WEB-INF/ or /META-INF/.
- CVE-2026-29146: EncryptInterceptor padding oracle — validate the configured cluster encryptionAlgorithm against an allow-list. GCM is now only accepted with NoPadding; NONE, ECB, PCBC, CTS, KW, KWP and CTR are refused outright, as are CBC, CFB and OFB with NoPadding and CFB/OFB at a non-default block size (CFB8, OFB64, ...); an unusable algorithm raises IllegalArgumentException at startup instead of failing later. CBC, CFB and OFB with PKCS5Padding continue to work but log a warning recommending AES/GCM/NoPadding. The default encryptionAlgorithm also changes from AES/CBC/PKCS5Padding to the authenticated AES/GCM/NoPadding, which is what actually removes the padding oracle for the deployments that never set the attribute explicitly. Rollout note: AES/GCM/NoPadding is not wire-compatible with AES/CBC/PKCS5Padding, so nodes on the old and new defaults cannot exchange cluster messages. The preferred procedure is to stop the whole cluster and restart it on the new package. If a rolling restart is unavoidable, first set encryptionAlgorithm="AES/CBC/PKCS5Padding" explicitly on every node, roll the package out, then remove that setting everywhere and restart once more. This pin is a rollout-window measure only and must not be left in place: for as long as it is set the cluster remains exposed to the padding oracle, and the fix is complete only once it has been removed.
- SECURITY UPDATE: fix for the following CVEs:
- References
-
- https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1786543355.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-24549
- https://nvd.nist.gov/vuln/detail/CVE-2024-34750
- https://nvd.nist.gov/vuln/detail/CVE-2024-50379
- https://nvd.nist.gov/vuln/detail/CVE-2024-52316
- https://nvd.nist.gov/vuln/detail/CVE-2025-48989
- https://nvd.nist.gov/vuln/detail/CVE-2025-55752
- https://nvd.nist.gov/vuln/detail/CVE-2026-29146