[CLSA-2026:1794452573] Fix CVE(s): CVE-2026-106023, CVE-2026-109163, CVE-2026-119618
Type:
security
Severity:
Critical
Release date:
2026-11-12 03:03:04 UTC
Description:
* SECURITY UPDATE: mod_vhost_alias: stack-based buffer overflow (off-by-one in size check) - debian/patches/CVE-2026-109163.patch: fix off-by-one in vhost_alias_checkspace() size check - CVE-2026-109163 * SECURITY UPDATE: mod_md: NULL pointer dereference on requests without a Host - debian/patches/CVE-2026-106023.patch: return early when the request has no hostname - CVE-2026-106023 * SECURITY UPDATE: mod_http2: race in assign_headers() can lead to RCE - debian/patches/CVE-2026-119618.patch: set Content-Length on r->headers_in instead of the shared request table - CVE-2026-119618
CVEs fixed:
Updated packages:
  • apache2_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:2ce9e23b4994a6c4ade7006691d9ab27444d5542
  • apache2-bin_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:f5d4450b8a5ec34593279312a40e6f9dc233514b
  • apache2-data_2.4.67-1~deb11u3+tuxcare.els2_all.deb
    sha:1923f9c8ce9c6cba90e824c90920b77a99f1e848
  • apache2-dev_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:1157cbdfec9cd29a14bc51faf22a8042aa4e0eb7
  • apache2-doc_2.4.67-1~deb11u3+tuxcare.els2_all.deb
    sha:24b49f99addde478213777e920d40333322d130a
  • apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:72f08298c339177d82436a53c58431e6a8541660
  • apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:5495151c6dc5ba494c1cd951c7fe5bbb20be8f88
  • apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:a0c2c9a66840a1fa344c381bb535406cf3310e2b
  • apache2-utils_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:e30cad2a5a0909a6d1df7c87f040c3308be658ba
  • libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:9354a82fe4df0450b4cfbc4e7248fb36d8d19e7b
  • libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els2_amd64.deb
    sha:c1b638f3521f193ce42acffff22a024aae8c3a49
  • apache2_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:00810f9c3a69c6faaeb256b76d1995329b0de1b1
  • apache2-bin_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:e437cb9e6c28f96c8b7a4c833e2ee9dfec596843
  • apache2-dev_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:059d4c3b917379dcd0231f23f1ee2463fa6c5c06
  • apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:d23778781fadd1d29e2397d9dd8949860c85cd70
  • apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:d71e2139a3954ebb1e0f8aefab5d7600e8e6800d
  • apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:b9b89f8dfc41ea10ada5120222fb8998ee1dd7c5
  • apache2-utils_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:b82f83f91376106ba2d8ba8fd65b17fc93677c75
  • libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:5e5e113271a85dcebbfb76c8d7fde39fe56c864f
  • libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els2_arm64.deb
    sha:82f097899cb2b0c6901ab9e507a5c3185f71396c
  • apache2_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:3a40f75fc22cde9e94fe7a61eff18a38ea105ce0
  • apache2-bin_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:c5d5c90dd9ce39599f38760fddd38a0f85d0053a
  • apache2-dev_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:8c8a9ac6f675238bc7994682c6950af550b40966
  • apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:088596aa05938d8442176c96bb0fa0948c861522
  • apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:fc09a821705a3334e4e8003a73729b07962b0ab6
  • apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:d04baf2a8ab77a57e65cd0f336ee487aa6598f69
  • apache2-utils_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:fb0239f1d0f17ec93becf15c741f316f9ffff4fc
  • libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:b3be282bcde8f120081563d7b6b17f1ccde3d5dd
  • libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els2_armel.deb
    sha:559e002f14ec7bc387f930c5e729f3a908ecac04
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.