{"id":"CLSA-2026-1791401910","summary":"Fix CVE(s): CVE-2026-56154, CVE-2026-63292, CVE-2026-63686","details":"   * SECURITY UPDATE: use-after-free of lookahead Vary value in mod_rewrite\n     - debian/patches/CVE-2026-56154.patch: copy the Vary header name into\n       r-\u003epool before destroying the LA-U/LA-F lookahead sub-request in\n       lookup_variable() in modules/mappers/mod_rewrite.c.\n     - CVE-2026-56154\n   * SECURITY UPDATE: stack buffer overflow in mod_vhost_alias interpolation\n     - debian/patches/CVE-2026-63292.patch: reject a VirtualDocumentRoot\n       segment that does not fit the HUGE_STRING_LEN buffer with HTTP 414\n       in vhost_alias_checkspace() in modules/mappers/mod_vhost_alias.c.\n     - CVE-2026-63292\n   * SECURITY UPDATE: mishandled incomplete input in mod_xml2enc\n     - debian/patches/CVE-2026-63686.patch: handle APR_INCOMPLETE from the\n       converter and pass unconverted input raw instead of looping on a\n       NULL converter in xml2enc_ffunc() in modules/filters/mod_xml2enc.c.\n     - CVE-2026-63686","modified":"2026-10-26T09:32:02.129164440Z","published":"2026-10-07T19:38:44Z","upstream":["CVE-2026-56154","CVE-2026-63292","CVE-2026-63686"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1791401910.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56154"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63292"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686"}],"affected":[{"package":{"name":"apache2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}},{"package":{"name":"apache2-bin","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-bin?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}},{"package":{"name":"apache2-data","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-data?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}},{"package":{"name":"apache2-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}},{"package":{"name":"apache2-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}},{"package":{"name":"apache2-suexec-custom","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-suexec-custom?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}},{"package":{"name":"apache2-suexec-pristine","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-suexec-pristine?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}},{"package":{"name":"apache2-utils","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-utils?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791401910.json"}}],"schema_version":"1.9.0"}