[CLSA-2026:1794437050] Fix of 12 CVEs

Type:

security

Severity:

Low

Release date:

2026-11-11 22:44:28 UTC

Description:

   * SECURITY UPDATE: guard against a null write request on a cancelled http2
     stream
     - debian/patches/CVE-2026-123875.patch: guard against a null write
       request on a cancelled http2 stream
     - CVE-2026-123875
   * SECURITY UPDATE: detect http2 streams abandoned by nghttp2
     - debian/patches/CVE-2026-123865.patch: detect http2 streams abandoned
       by nghttp2
     - CVE-2026-123865
   * SECURITY UPDATE: avoid overflowing ALTSVC buffers
     - debian/patches/CVE-2026-123828.patch: avoid overflowing ALTSVC buffers
     - CVE-2026-123828
   * SECURITY UPDATE: handle zlib params callback after destroy
     - debian/patches/CVE-2026-123862.patch: handle zlib params callback
       after destroy
     - CVE-2026-123862
   * SECURITY UPDATE: release http2 headers when a stream is removed
     - debian/patches/CVE-2026-123863.patch: release http2 headers when a
       stream is removed
     - CVE-2026-123863
   * SECURITY UPDATE: prevent nested parser execution from empty writes
     - debian/patches/CVE-2026-123864.patch: prevent nested parser execution
       from empty writes
     - CVE-2026-123864
   * SECURITY UPDATE: apply the CA of SNI contexts without a certificate
     - debian/patches/CVE-2026-123867.patch: apply the CA of SNI contexts
       without a certificate
     - CVE-2026-123867
   * SECURITY UPDATE: isolate https Agent TLS policy keys
     - debian/patches/CVE-2026-123877.patch: isolate https Agent TLS policy
       keys
     - CVE-2026-123877
   * SECURITY UPDATE: retain http2 buffers until socket writes finish
     - debian/patches/CVE-2026-123866.patch: retain http2 buffers until
       socket writes finish
     - CVE-2026-123866
   * SECURITY UPDATE: charge inbound DATA retained by streams to
     maxSessionMemory
     - debian/patches/CVE-2026-123868.patch: charge inbound DATA retained by
       streams to maxSessionMemory
     - CVE-2026-123868
   * SECURITY UPDATE: prevent TLS resumption, renegotiation and HRR from
     changing SNI
     - debian/patches/CVE-2026-123872.patch: prevent TLS resumption,
       renegotiation and HRR from changing SNI
     - CVE-2026-123872
   * SECURITY UPDATE: retain http2 streams during pending writes
     - debian/patches/CVE-2026-123874.patch: retain http2 streams during
       pending writes
     - CVE-2026-123874

CVEs fixed:

Updated packages:

alt-nodejs18-docs_18.20.8-27_amd64.deb
sha:9e303b6d975ab6bca971f1ead0206bd223dacdb5
alt-nodejs18-nodejs_18.20.8-27_amd64.deb
sha:9c9c818a8a909f9104adbfae6905b327f91145b1
alt-nodejs18-nodejs-devel_18.20.8-27_amd64.deb
sha:2fc0e74493dbd4de0c6fc72f0d66a08998191da4
alt-nodejs18-npm_10.8.2-18.20.8.27_amd64.deb
sha:256934987ca866cd790e77b079a56bf0d498a058

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.