CLSA-2026-1791970059
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791970059.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791970059
- Upstream
CVE (2)
- CVE-2026-44185
- CVE-2026-46729
- Published
- 2026-10-14T09:27:50Z
- Modified
- 2026-10-26T09:32:06Z
- Summary
- Fix CVE(s): CVE-2026-44185, CVE-2026-46729
- Details
-
- SECURITY UPDATE: buffer over-read in mod_ssl OCSP requests
- debian/patches/CVE-2026-44185.patch: in send_request() in modules/ssl/ssl_util_ocsp.c, advance the write pointer by the number of bytes actually sent instead of the total remaining length so a short write to an attacker controlled OCSP responder can no longer read past the end of the stack buffer. Backported from httpd commit 32b7e2e66477020ba75b78ab43fb8890ec292ad2 (SVN r1934919).
- CVE-2026-44185
- SECURITY UPDATE: NULL pointer dereference in mod_heartmonitor
- debian/patches/CVE-2026-46729.patch: in hm_handler() in modules/cluster/mod_heartmonitor.c, reject requests when the module is not active or the body exceeds MAX_MSG_LEN, require the busy and ready parameters, and parse port, busy and ready with strtol() so a crafted unicast heartbeat can no longer dereference a NULL pointer. Backported from httpd commit 7b12a7936ec439b3e1f5fc36cfacf5b915eb652c (SVN r1938654).
- CVE-2026-46729
- SECURITY UPDATE: buffer over-read in mod_ssl OCSP requests
- References