{"id":"CLSA-2026-1791889844","summary":"httpd: Fix of 11 CVEs","details":"- CVE-2026-63718: mod_proxy_uwsgi: drop hop-by-hop headers from the backend\n  response\n- CVE-2026-73636: mod_auth_digest: accept a one-time nonce only once, also when\n  the client entry was garbage collected\n- CVE-2026-73637: mod_auth_digest: don't use a client entry outside the client\n  lock\n- CVE-2026-48005: mod_auth_digest: track the nonce-count per nonce and record it\n  only for a fully verified request\n- mod_auth_digest: configs using \"AuthDigestQop none\" or the \"authdigest-opaque\"\n  Mutex type no longer start (\"AuthDigestQop none\" in .htaccess: 500; the\n  shipped manual still documents it); RFC 2069 clients (no qop) are refused;\n  with AuthDigestNcCheck On or AuthDigestNonceLifetime 0, 503 if no client\n  entry fits in shared memory; log ids AH01767, AH01771, AH01772, AH01792\n  and AH01793 are removed\n- mod_auth_digest: with AuthDigestNcCheck On, a request that is authenticated\n  twice (e.g. a DirectoryIndex file in its own \u003cFiles\u003e section) is refused\n  with 401\n- mod_auth_digest: after a reload (also the logrotate one) or a SIGHUP restart\n  a captured request can be accepted once more under AuthDigestNonceLifetime 0\n  or AuthDigestNcCheck; only stopping httpd (systemctl restart) invalidates\n  it (fixed upstream only in trunk f4c4160fbf, not in 2.4.69)\n- CVE-2026-63686: mod_xml2enc: avoid a NULL pointer dereference when a charset\n  conversion fails part way\n- CVE-2026-63045: mod_proxy_ftp: reject a PASV reply whose address differs from\n  the control connection peer\n- CVE-2026-42528: mod_dav: limit the number of shared locks on a resource\n- CVE-2026-93546: mod_dav_fs: cap the property database namespace table at 2048\n  entries\n- CVE-2026-58415: mod_dav_fs: deny access to the .DAV state directory for all\n  methods, including GET\n- CVE-2026-59797: mod_ssl: don't allow file() and filesize() in SSLRequire from\n  .htaccess files\n- CVE-2026-79768: mod_userdir: reject \".\" as a user name","modified":"2026-10-26T09:43:50.917066975Z","published":"2026-10-13T11:11:01Z","upstream":["CVE-2026-42528","CVE-2026-48005","CVE-2026-58415","CVE-2026-59797","CVE-2026-63045","CVE-2026-63686","CVE-2026-63718","CVE-2026-73636","CVE-2026-73637","CVE-2026-79768","CVE-2026-93546"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791889844.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42528"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48005"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58415"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59797"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63045"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63718"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73636"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73637"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79768"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93546"}],"affected":[{"package":{"name":"httpd","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/httpd?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"httpd-core","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/httpd-core?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"httpd-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/httpd-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"httpd-filesystem","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/httpd-filesystem?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"httpd-manual","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/httpd-manual?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"httpd-tools","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/httpd-tools?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"mod_ldap","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/mod_ldap?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"mod_lua","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/mod_lua?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"mod_proxy_html","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/mod_proxy_html?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"mod_session","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/mod_session?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}},{"package":{"name":"mod_ssl","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/mod_ssl?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791889844.json"}}],"schema_version":"1.9.0"}