DSA-6248-1 apache2 - security update
⚠️ Importante
https://security-tracker.debian.org/tracker/DSA-6248-1
Debian
2026-05-06 00:00 UTC · 2026-05-05 21:00 -03
https://security-tracker.debian.org/tracker/DSA-6248-1
https://security-tracker.debian.org/tracker/DSA-6249-1
It was discovered that Mako incorrectly handled URIs with double-slash prefixes in TemplateLookup. A remote attacker could possibly use this issue to obtain sensitive information.
Andrew MacPherson discovered that nghttp2 did not properly validate internal state when the session termination API was called. A remote attacker could possibly use this issue to cause nghttp2 to crash, resulting in a denial of service.