{"id":"CLSA-2026-1791450651","summary":"Fix of 5 CVEs","details":"   * SECURITY UPDATE: use-after-free in mod_rewrite lookahead variables\n     - debian/patches/CVE-2026-56154.patch: copy the Vary value gathered\n       during a LA-U/LA-F lookahead into the main request pool before the\n       sub-request is destroyed in modules/mappers/mod_rewrite.c.\n     - CVE-2026-56154\n   * SECURITY UPDATE: buffer overflow in mod_vhost_alias interpolation\n     - debian/patches/CVE-2026-63292.patch: reject a VirtualDocumentRoot\n       expansion segment that does not fit the buffer in\n       modules/mappers/mod_vhost_alias.c.\n     - CVE-2026-63292\n   * SECURITY UPDATE: crash in mod_xml2enc on incomplete input\n     - debian/patches/CVE-2026-63686.patch: handle APR_INCOMPLETE from the\n       converter and pass the rest raw after a conversion failure instead\n       of reusing a NULL converter in modules/filters/mod_xml2enc.c.\n     - CVE-2026-63686\n   * SECURITY UPDATE: digest replay and use-after-free in mod_auth_digest\n     - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: enforce one-time\n       nonce and nonce-count handling, and only use shared client entries\n       under the client lock, in modules/aaa/mod_auth_digest.c.\n     - CVE-2026-73636\n     - CVE-2026-73637","modified":"2026-10-26T09:32:04.625865731Z","published":"2026-10-08T09:11:08Z","upstream":["CVE-2026-56154","CVE-2026-63292","CVE-2026-63686","CVE-2026-73636","CVE-2026-73637"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791450651.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56154"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63292"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73636"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73637"}],"affected":[{"package":{"name":"apache2","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-bin","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-bin?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-data","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-data?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-ssl-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-ssl-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-suexec-custom","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-suexec-custom?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-suexec-pristine","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-suexec-pristine?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}},{"package":{"name":"apache2-utils","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/apache2-utils?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.27+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1791450651.json"}}],"schema_version":"1.9.0"}