CLSA-2026-1791447288
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791447288.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791447288
- Upstream
CVE (5)
- CVE-2026-56153
- CVE-2026-56154
- CVE-2026-56449
- CVE-2026-57941
- CVE-2026-63292
- Published
- 2026-10-08T08:15:07Z
- Modified
- 2026-10-26T09:43:41Z
- Summary
- Fix of 5 CVEs
- Details
-
- SECURITY UPDATE: out-of-bounds write in mod_charset_lite
- debian/patches/CVE-2026-56153.patch: in finish_partial_char() in modules/filters/mod_charset_lite.c, stop accumulating a split multibyte character once ctx->saved reaches the size of ctx->buf so the next byte can no longer be written past the 8-byte buffer. Backported from httpd commit 6654234dcb395e07fd62255670356f84ec733195 (SVN r1938658).
- CVE-2026-56153
- SECURITY UPDATE: use-after-free in mod_rewrite lookahead variables
- debian/patches/CVE-2026-56154.patch: in lookup_variable() in modules/mappers/mod_rewrite.c, copy ctx->vary_this into the main request pool after an LA-U/LA-F lookahead sub-request so the Vary header name no longer points into the destroyed sub-request pool. Backported from httpd commit 6e4d1e614597109909dda495d235b6a1331d7beb (SVN r1938660).
- CVE-2026-56154
- SECURITY UPDATE: out-of-bounds write in mod_proxy_html
- debian/patches/CVE-2026-56449.patch: in pcomment() in modules/filters/mod_proxy_html.c, do not call dump_content() after writing an HTML comment so crafted response bodies can no longer trigger a write outside the output buffer. Backported from httpd commit c721d4e1cf5c142149509490015cef1a75715595 (SVN r1935931).
- CVE-2026-56449
- SECURITY UPDATE: stack-based buffer overflow in mod_vhost_alias
- debian/patches/CVE-2026-63292.patch: in vhost_alias_checkspace() and vhost_alias_interpolate() in modules/mappers/mod_vhost_alias.c, reject a single expanded segment (e.g. a Host header) of HUGE_STRING_LEN bytes or more with 414 instead of writing past the stack buffer. Backported from httpd commit 7ed3f91688b7a1e1ac48486fd2e5eeb2932e879f (SVN r1938675).
- CVE-2026-63292
- SECURITY UPDATE: use-after-free in mod_http2 via session->bbtmp
- debian/patches/CVE-2026-57941.patch: in modules/http2/h2_session.c, h2_c1_io.c and h2_mplx.c, use a per-call brigade instead of the shared session->bbtmp in on_send_data_cb() and ev_stream_closed(), remove buckets before feeding them, guard stream cleanup against re-entrancy with in_stream_cleanup/mplx_cleanup_done, and allocate the input/output iqueues from a separate pool. Backported from httpd commit d072ed8f06d66a30072227d61a2fc04ad9ae5c99 (SVN r1938665).
- CVE-2026-57941
- SECURITY UPDATE: out-of-bounds write in mod_charset_lite
- References
-
- https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791447288.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-56153
- https://nvd.nist.gov/vuln/detail/CVE-2026-56154
- https://nvd.nist.gov/vuln/detail/CVE-2026-56449
- https://nvd.nist.gov/vuln/detail/CVE-2026-57941
- https://nvd.nist.gov/vuln/detail/CVE-2026-63292