{"id":"CLSA-2026-1782293598","summary":"Fix CVE(s): CVE-2026-44119, CVE-2026-44185, CVE-2026-44186, CVE-2026-44631","details":"   * SECURITY UPDATE: mod_proxy_ftp infinite loop in Retry-After parsing\n     - debian/patches/CVE-2026-44186.patch: advance secs_str in the\n       digit-scan loop in modules/proxy/mod_proxy_ftp.c.\n     - CVE-2026-44186\n   * SECURITY UPDATE: mod_ssl OCSP request corruption on short socket write\n     - debian/patches/CVE-2026-44185.patch: advance the write buffer by the\n       bytes actually sent (wlen) in modules/ssl/ssl_util_ocsp.c.\n     - CVE-2026-44185\n   * SECURITY UPDATE: ap_regname unbounded capture-group allocation (DoS)\n     - debian/patches/CVE-2026-44631.patch: read capture index bytes as\n       unsigned and reject captures \u003e 1024 in server/util_pcre.c, and treat\n       a negative ap_regname() return as an error in server/core.c and\n       modules/proxy/mod_proxy.c.\n     - CVE-2026-44631\n   * SECURITY UPDATE: ap_expr file functions exposable from .htaccess\n     - debian/patches/CVE-2026-44119.patch: restrict file functions/tests\n       centrally in ap_expr_parse_cmd_mi() via a new\n       AP_EXPR_FLAG_RESTRICTED_FILE_FUNC flag in include/ap_expr.h and\n       server/util_expr_eval.c, dropping the per-module restriction in\n       modules/mappers/mod_rewrite.c and modules/metadata/mod_setenvif.c.\n     - CVE-2026-44119","modified":"2026-10-26T09:32:01.714082920Z","published":"2026-06-24T09:33:40Z","upstream":["CVE-2026-44119","CVE-2026-44185","CVE-2026-44186","CVE-2026-44631"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1782293598.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44119"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44185"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44186"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44631"}],"affected":[{"package":{"name":"apache2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}},{"package":{"name":"apache2-bin","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-bin?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}},{"package":{"name":"apache2-data","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-data?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}},{"package":{"name":"apache2-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}},{"package":{"name":"apache2-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}},{"package":{"name":"apache2-suexec-custom","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-suexec-custom?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}},{"package":{"name":"apache2-suexec-pristine","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-suexec-pristine?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}},{"package":{"name":"apache2-utils","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-utils?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782293598.json"}}],"schema_version":"1.9.0"}