{"id":"CLSA-2026-1781627270","summary":"httpd: Fix of 5 CVEs","details":"- CVE-2026-29167: mod_ldap: use-after-free in per-directory configuration —\n  deep-copy the client certificate list (and referenced path/password\n  strings) into the connection pool instead of a shallow header copy\n- CVE-2026-29170: mod_proxy_ftp: cross-site scripting in the generated FTP\n  directory listing — escape href filenames with ap_os_escape_path() wrapped\n  in ap_escape_html() instead of ap_escape_uri()\n- CVE-2026-34355: mod_proxy_html: heap buffer overflow reachable from an\n  untrusted backend — replace hand-rolled buffer management with the\n  ap_varbuf API\n- CVE-2026-42535: mod_dav_fs: deny WebDAV access to/within the .DAV state\n  directory in dav_fs_get_resource()\n- CVE-2026-42536: mod_xml2enc: heap buffer overflow in fix_skipto — keep the\n  buffer length (bblen) accounting in sync when advancing the buffer","modified":"2026-10-26T09:31:57.766511722Z","published":"2026-06-16T16:28:08Z","upstream":["CVE-2026-29167","CVE-2026-29170","CVE-2026-34355","CVE-2026-42535","CVE-2026-42536"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1781627270.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29167"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29170"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34355"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42535"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42536"}],"affected":[{"package":{"name":"httpd","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/httpd?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}},{"package":{"name":"httpd-devel","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/httpd-devel?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}},{"package":{"name":"httpd-manual","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/httpd-manual?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}},{"package":{"name":"httpd-tools","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/httpd-tools?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}},{"package":{"name":"mod_ldap","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/mod_ldap?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}},{"package":{"name":"mod_proxy_html","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/mod_proxy_html?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}},{"package":{"name":"mod_session","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/mod_session?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}},{"package":{"name":"mod_ssl","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/mod_ssl?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7_9.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781627270.json"}}],"schema_version":"1.9.0"}