[CLSA-2026:1794441522] Fix of 12 CVEs

Type:

security

Severity:

Low

Release date:

2026-11-11 23:58:59 UTC

Description:

   * SECURITY UPDATE: guard against a null write request on a cancelled http2
     stream
     - debian/patches/CVE-2026-123875.patch: guard against a null write
       request on a cancelled http2 stream
     - CVE-2026-123875
   * SECURITY UPDATE: detect http2 streams abandoned by nghttp2
     - debian/patches/CVE-2026-123865.patch: detect http2 streams abandoned
       by nghttp2
     - CVE-2026-123865
   * SECURITY UPDATE: avoid overflowing ALTSVC buffers
     - debian/patches/CVE-2026-123828.patch: avoid overflowing ALTSVC buffers
     - CVE-2026-123828
   * SECURITY UPDATE: handle zlib params callback after destroy
     - debian/patches/CVE-2026-123862.patch: handle zlib params callback
       after destroy
     - CVE-2026-123862
   * SECURITY UPDATE: release http2 headers when a stream is removed
     - debian/patches/CVE-2026-123863.patch: release http2 headers when a
       stream is removed
     - CVE-2026-123863
   * SECURITY UPDATE: prevent nested parser execution from empty writes
     - debian/patches/CVE-2026-123864.patch: prevent nested parser execution
       from empty writes
     - CVE-2026-123864
   * SECURITY UPDATE: apply the CA of SNI contexts without a certificate
     - debian/patches/CVE-2026-123867.patch: apply the CA of SNI contexts
       without a certificate
     - CVE-2026-123867
   * SECURITY UPDATE: isolate https Agent TLS policy keys
     - debian/patches/CVE-2026-123877.patch: isolate https Agent TLS policy
       keys
     - CVE-2026-123877
   * SECURITY UPDATE: retain http2 buffers until socket writes finish
     - debian/patches/CVE-2026-123866.patch: retain http2 buffers until
       socket writes finish
     - CVE-2026-123866
   * SECURITY UPDATE: charge inbound DATA retained by streams to
     maxSessionMemory
     - debian/patches/CVE-2026-123868.patch: charge inbound DATA retained by
       streams to maxSessionMemory
     - CVE-2026-123868
   * SECURITY UPDATE: prevent TLS resumption, renegotiation and HRR from
     changing SNI
     - debian/patches/CVE-2026-123872.patch: prevent TLS resumption,
       renegotiation and HRR from changing SNI
     - CVE-2026-123872
   * SECURITY UPDATE: retain http2 streams during pending writes
     - debian/patches/CVE-2026-123874.patch: retain http2 streams during
       pending writes
     - CVE-2026-123874

CVEs fixed:

Updated packages:

alt-nodejs18-docs_18.20.8-27_amd64.deb
sha:189497ff8f485adcf3d515566214bcea3f9b0f31
alt-nodejs18-nodejs_18.20.8-27_amd64.deb
sha:002f49eb7e080be91dd55d7c4e81cdefe1328d0b
alt-nodejs18-nodejs-devel_18.20.8-27_amd64.deb
sha:8d2e3ea268c32fe2ce1826b9b561b17c7137072c
alt-nodejs18-npm_10.8.2-18.20.8.27_amd64.deb
sha:59469c4415dd3ca6c4fd9d0db1a35a26eb761f80
alt-nodejs18-docs_18.20.8-27_arm64.deb
sha:30b372a69a6f4ab73dd032da111a8e46bf59edda
alt-nodejs18-nodejs_18.20.8-27_arm64.deb
sha:219002ec6221b9617e725271d9a6b4003d3b6e5f
alt-nodejs18-nodejs-devel_18.20.8-27_arm64.deb
sha:e98cf1cc7eb8469f2a35b5066ab60787eea0b021
alt-nodejs18-npm_10.8.2-18.20.8.27_arm64.deb
sha:264ee4b4e54e57952025ac8001f874816a22fab5

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.