CLSA-2026-1791889844
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791889844
- Upstream
CVE (11)
- CVE-2026-42528
- CVE-2026-48005
- CVE-2026-58415
- CVE-2026-59797
- CVE-2026-63045
- CVE-2026-63686
- CVE-2026-63718
- CVE-2026-73636
- CVE-2026-73637
- CVE-2026-79768
- CVE-2026-93546
- Published
- 2026-10-13T11:11:01Z
- Modified
- 2026-10-26T09:43:50Z
- Summary
- httpd: Fix of 11 CVEs
- Details
-
- CVE-2026-63718: mod_proxy_uwsgi: drop hop-by-hop headers from the backend response
- CVE-2026-73636: mod_auth_digest: accept a one-time nonce only once, also when the client entry was garbage collected
- CVE-2026-73637: mod_auth_digest: don't use a client entry outside the client lock
- CVE-2026-48005: mod_auth_digest: track the nonce-count per nonce and record it only for a fully verified request
- mod_auth_digest: configs using "AuthDigestQop none" or the "authdigest-opaque" Mutex type no longer start ("AuthDigestQop none" in .htaccess: 500; the shipped manual still documents it); RFC 2069 clients (no qop) are refused; with AuthDigestNcCheck On or AuthDigestNonceLifetime 0, 503 if no client entry fits in shared memory; log ids AH01767, AH01771, AH01772, AH01792 and AH01793 are removed
- mod_auth_digest: with AuthDigestNcCheck On, a request that is authenticated twice (e.g. a DirectoryIndex file in its own section) is refused with 401
- mod_auth_digest: after a reload (also the logrotate one) or a SIGHUP restart a captured request can be accepted once more under AuthDigestNonceLifetime 0 or AuthDigestNcCheck; only stopping httpd (systemctl restart) invalidates it (fixed upstream only in trunk f4c4160fbf, not in 2.4.69)
- CVE-2026-63686: mod_xml2enc: avoid a NULL pointer dereference when a charset conversion fails part way
- CVE-2026-63045: mod_proxy_ftp: reject a PASV reply whose address differs from the control connection peer
- CVE-2026-42528: mod_dav: limit the number of shared locks on a resource
- CVE-2026-93546: mod_dav_fs: cap the property database namespace table at 2048 entries
- CVE-2026-58415: mod_dav_fs: deny access to the .DAV state directory for all methods, including GET
- CVE-2026-59797: mod_ssl: don't allow file() and filesize() in SSLRequire from .htaccess files
- CVE-2026-79768: mod_userdir: reject "." as a user name
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791889844.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-42528
- https://nvd.nist.gov/vuln/detail/CVE-2026-48005
- https://nvd.nist.gov/vuln/detail/CVE-2026-58415
- https://nvd.nist.gov/vuln/detail/CVE-2026-59797
- https://nvd.nist.gov/vuln/detail/CVE-2026-63045
- https://nvd.nist.gov/vuln/detail/CVE-2026-63686
- https://nvd.nist.gov/vuln/detail/CVE-2026-63718
- https://nvd.nist.gov/vuln/detail/CVE-2026-73636
- https://nvd.nist.gov/vuln/detail/CVE-2026-73637
- https://nvd.nist.gov/vuln/detail/CVE-2026-79768
- https://nvd.nist.gov/vuln/detail/CVE-2026-93546