[CLSA-2026:1794435874] Fix of 12 CVEs

Type:

security

Severity:

Low

Release date:

2026-11-11 22:24:49 UTC

Description:

   * SECURITY UPDATE: guard against a null write request on a cancelled http2
     stream
     - debian/patches/CVE-2026-123875.patch: guard against a null write
       request on a cancelled http2 stream
     - CVE-2026-123875
   * SECURITY UPDATE: detect http2 streams abandoned by nghttp2
     - debian/patches/CVE-2026-123865.patch: detect http2 streams abandoned
       by nghttp2
     - CVE-2026-123865
   * SECURITY UPDATE: avoid overflowing ALTSVC buffers
     - debian/patches/CVE-2026-123828.patch: avoid overflowing ALTSVC buffers
     - CVE-2026-123828
   * SECURITY UPDATE: handle zlib params callback after destroy
     - debian/patches/CVE-2026-123862.patch: handle zlib params callback
       after destroy
     - CVE-2026-123862
   * SECURITY UPDATE: release http2 headers when a stream is removed
     - debian/patches/CVE-2026-123863.patch: release http2 headers when a
       stream is removed
     - CVE-2026-123863
   * SECURITY UPDATE: prevent nested parser execution from empty writes
     - debian/patches/CVE-2026-123864.patch: prevent nested parser execution
       from empty writes
     - CVE-2026-123864
   * SECURITY UPDATE: apply the CA of SNI contexts without a certificate
     - debian/patches/CVE-2026-123867.patch: apply the CA of SNI contexts
       without a certificate
     - CVE-2026-123867
   * SECURITY UPDATE: isolate https Agent TLS policy keys
     - debian/patches/CVE-2026-123877.patch: isolate https Agent TLS policy
       keys
     - CVE-2026-123877
   * SECURITY UPDATE: retain http2 buffers until socket writes finish
     - debian/patches/CVE-2026-123866.patch: retain http2 buffers until
       socket writes finish
     - CVE-2026-123866
   * SECURITY UPDATE: charge inbound DATA retained by streams to
     maxSessionMemory
     - debian/patches/CVE-2026-123868.patch: charge inbound DATA retained by
       streams to maxSessionMemory
     - CVE-2026-123868
   * SECURITY UPDATE: prevent TLS resumption, renegotiation and HRR from
     changing SNI
     - debian/patches/CVE-2026-123872.patch: prevent TLS resumption,
       renegotiation and HRR from changing SNI
     - CVE-2026-123872
   * SECURITY UPDATE: retain http2 streams during pending writes
     - debian/patches/CVE-2026-123874.patch: retain http2 streams during
       pending writes
     - CVE-2026-123874

CVEs fixed:

Updated packages:

alt-nodejs18-docs_18.20.8-27_amd64.deb
sha:afcfba6529f6b1cd03309bfec7d4d62d551f70d2
alt-nodejs18-nodejs_18.20.8-27_amd64.deb
sha:7e6ce776f99aed18e7650b05925c8547dd71bbf3
alt-nodejs18-nodejs-devel_18.20.8-27_amd64.deb
sha:6b30d9a51e7c2dba2623ec6f8d4a70282bdcd481
alt-nodejs18-npm_10.8.2-18.20.8.27_amd64.deb
sha:7bc6cb302070bfc707df661c16fe8ffe1b2df8fd
alt-nodejs18-docs_18.20.8-27_arm64.deb
sha:38cf765489161d8ab74780cffc6841d25fe9f276
alt-nodejs18-nodejs_18.20.8-27_arm64.deb
sha:db8d23aba648940f8e59fd0d61307be9d90253de
alt-nodejs18-nodejs-devel_18.20.8-27_arm64.deb
sha:56eff67d8b59fd42ba5b7539046694c8d0c88093
alt-nodejs18-npm_10.8.2-18.20.8.27_arm64.deb
sha:4436be8089d69525dd15f8c5e6dadf3aa0669efb

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.