[CLSA-2026:1781255857] httpd: Fix of 3 CVEs
Type:
security
Severity:
Important
Release date:
2026-06-12 09:17:59 UTC
Description:
- CVE-2026-34356: mod_proxy: honor only last cookie path/domain - CVE-2026-29170: mod_proxy_ftp: escape filenames in dir listing - CVE-2026-34355: mod_proxy_html: use ap_varbuf to fix overflow
CVEs fixed:
Updated packages:
  • httpd-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:99282d5ffaf7964780bd82de14c034314f0c801c9a1e6073c240cc0aa2376797
  • httpd-core-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:108763cd1e4cd1f9e52dde2ae45220a3f5c6f0939ea6e09fc9d97b9a7d2891f7
  • httpd-devel-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:95b434aec4b4ee3a66541b5bb0800d347a195b44f401cf888117922ab1a1d6ca
  • httpd-filesystem-2.4.62-4.el9_6.4.tuxcare.els5.noarch.rpm
    sha:4c7a29b05210252d350f6473895dd4bb7962c35951c5e567e8836fd1a23bf814
  • httpd-manual-2.4.62-4.el9_6.4.tuxcare.els5.noarch.rpm
    sha:acc3ecf06101d60f409fd2e14d7fac3b41cd2a158f45b538ff393403a196aba0
  • httpd-tools-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:c5a77fe9df7533fa6761e7b3cfee9e5d84bf48493a9d694543dc16389fa0501e
  • mod_ldap-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:7a4afa94d59d9a7304212a1fee836fc12eaca656af298ea1498c34eccd1d0c33
  • mod_lua-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:870613616ede547bbb8829bbcd74fc419ec08647cb9313a70a6f81713f25bc7a
  • mod_proxy_html-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:79bb466ddac03291547224570f33511ad597729a25126c24f2cd33488ae4a9d1
  • mod_session-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:2ba34e3e1d370f4f8a99e4f98e8aeb179538fc7b7342cc174cf28a140192b775
  • mod_ssl-2.4.62-4.el9_6.4.tuxcare.els5.x86_64.rpm
    sha:e2e656f4d77e7409b47de8fc44374e4a2d207d20a58300c6dabdec11bac5d4d8
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.