CLSA-2026-1792487559
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792487559.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792487559
- Upstream
CVE (2)
- CVE-2026-15176
- CVE-2026-56434
- Published
- 2026-10-20T09:12:52Z
- Modified
- 2026-10-26T09:32:05Z
- Summary
- Fix CVE(s): CVE-2026-15176, CVE-2026-56434
- Details
-
- SECURITY UPDATE: heap buffer overflow when mapping a rewritten URI to a
path in a location using alias
- debian/patches/CVE-2026-15176.patch: reject URI to path mapping in ngx_http_map_uri_to_path() when r->uri_changed is set, so a rewrite that shortens the URI below the alias location prefix can no longer overflow the path buffer through $request_filename
- CVE-2026-15176
- SECURITY UPDATE: use-after-free via duplicate subrequest finalization
- debian/patches/CVE-2026-56434.patch: skip posting a request in ngx_http_post_request() if it is already posted, and reset the subrequest write event handler during finalization in ngx_http_finalize_request(), so an SSI subrequest double-posted during unbuffered proxying can no longer be finalized twice
- CVE-2026-56434
- SECURITY UPDATE: heap buffer overflow when mapping a rewritten URI to a
path in a location using alias
- References