[CLSA-2026:1794452916] Fix CVE(s): CVE-2026-106023, CVE-2026-109163, CVE-2026-119618
Type:
security
Severity:
Critical
Release date:
2026-11-12 03:08:48 UTC
Description:
* SECURITY UPDATE: mod_vhost_alias: stack-based buffer overflow (off-by-one in size check) - debian/patches/CVE-2026-109163.patch: fix off-by-one in vhost_alias_checkspace() size check - CVE-2026-109163 * SECURITY UPDATE: mod_md: NULL pointer dereference on requests without a Host - debian/patches/CVE-2026-106023.patch: return early when the request has no hostname - CVE-2026-106023 * SECURITY UPDATE: mod_http2: race in assign_headers() can lead to RCE - debian/patches/CVE-2026-119618.patch: set Content-Length on r->headers_in instead of the shared request table - CVE-2026-119618
CVEs fixed:
Updated packages:
  • apache2_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:838ddb4e431bb500398757ff2bac2333dce3357c
  • apache2-bin_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:f3d3532e810fa346f381fc856cba0fa62a2d37d4
  • apache2-data_2.4.59-1~deb10u1+tuxcare.els16_all.deb
    sha:cabef5d550bdf759f82fa4d99a3ceab6b5d3cf34
  • apache2-dev_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:f6125e9fbed79571c11ba1e5982ab5c4cac5a41a
  • apache2-doc_2.4.59-1~deb10u1+tuxcare.els16_all.deb
    sha:6e7ebf6c5af4d0f24ce8f7e8f066511fa8a5a462
  • apache2-ssl-dev_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:5ebf08aa36816335551e9f832b78effb17760c65
  • apache2-suexec-custom_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:af59db98cd0b78d1955b36181dc02b048aa60096
  • apache2-suexec-pristine_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:a2a1f05bdc2bb18f5522ffbaab9248ef63d7839d
  • apache2-utils_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:43164ccc59834bbeceefe0ba6508fa26299369dd
  • libapache2-mod-md_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:99dc25c5b2363d8d2de18715e244657e66db4740
  • libapache2-mod-proxy-uwsgi_2.4.59-1~deb10u1+tuxcare.els16_amd64.deb
    sha:f7964f77c5e5adb0e841b0712053fd5cba965556
  • apache2_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:2041987a6b7b1694d308c7531a887c1db5eb4845
  • apache2-bin_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:676117308a025484829eacc1f71173de882758ea
  • apache2-dev_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:596d8f9a9385adc4a59a9f0a388fe4153d2cc8c3
  • apache2-ssl-dev_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:132e660c5b92c9471389059ed859f809c435584c
  • apache2-suexec-custom_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:d9ff5986a006c6428e8466ea5adcdea2a0a229eb
  • apache2-suexec-pristine_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:fccd043b4e95c1e06cc3ff716e14f12787fc3d65
  • apache2-utils_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:a2607ecf9bf32c7eeb519851cb78cbc4c48f0233
  • libapache2-mod-md_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:d94712178564f6a9c2276d38915e556740b2f46e
  • libapache2-mod-proxy-uwsgi_2.4.59-1~deb10u1+tuxcare.els16_arm64.deb
    sha:ae2af71a1684edfeb9d1e93aca12fe743a41d1c2
  • apache2_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:5a5a79d39a7f9efca825049d437044c4a4b332f4
  • apache2-bin_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:2757bf1af2257adcd5c427428e9ffb92f41f8e07
  • apache2-dev_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:787912baed432255bffa6745f22aae4735eb9735
  • apache2-ssl-dev_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:b85da88d774eaad48d6229c1b39c43d868628a59
  • apache2-suexec-custom_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:f15e0e7c3b3f1276d7825fef2217b966639dfa03
  • apache2-suexec-pristine_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:4e8d0c879dcc073ec8cb02bb153ddde388eb3f92
  • apache2-utils_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:fc5a86603dad9a8909e1de45bfbe948bb3c612e1
  • libapache2-mod-md_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:5b80d558aec11ee781a2403309d9939f299c453f
  • libapache2-mod-proxy-uwsgi_2.4.59-1~deb10u1+tuxcare.els16_armel.deb
    sha:5e558fa4e3b1081754132c95ed8571e319490ffe
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.