CLSA-2026-1791401910
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791401910
- Upstream
CVE (3)
- CVE-2026-56154
- CVE-2026-63292
- CVE-2026-63686
- Published
- 2026-10-07T19:38:44Z
- Modified
- 2026-10-26T09:32:02Z
- Summary
- Fix CVE(s): CVE-2026-56154, CVE-2026-63292, CVE-2026-63686
- Details
-
- SECURITY UPDATE: use-after-free of lookahead Vary value in mod_rewrite
- debian/patches/CVE-2026-56154.patch: copy the Vary header name into r->pool before destroying the LA-U/LA-F lookahead sub-request in lookup_variable() in modules/mappers/mod_rewrite.c.
- CVE-2026-56154
- SECURITY UPDATE: stack buffer overflow in mod_vhost_alias interpolation
- debian/patches/CVE-2026-63292.patch: reject a VirtualDocumentRoot segment that does not fit the HUGE_STRING_LEN buffer with HTTP 414 in vhost_alias_checkspace() in modules/mappers/mod_vhost_alias.c.
- CVE-2026-63292
- SECURITY UPDATE: mishandled incomplete input in mod_xml2enc
- debian/patches/CVE-2026-63686.patch: handle APR_INCOMPLETE from the converter and pass unconverted input raw instead of looping on a NULL converter in xml2enc_ffunc() in modules/filters/mod_xml2enc.c.
- CVE-2026-63686
- SECURITY UPDATE: use-after-free of lookahead Vary value in mod_rewrite
- References