mbox series

[meta-webserver,wrynose,00/11] nginx: Security fixes

Message ID 20261016032056.409095-1-hthakar@cisco.com
Headers show
Series nginx: Security fixes | expand

Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 3:20 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This series backports the upstream nginx security fixes for the
following CVEs to nginx 1.28.3 and 1.29.7 in Wrynose:

- CVE-2026-40701
- CVE-2026-42934
- CVE-2026-42946
- CVE-2026-42945
- CVE-2026-9256
- CVE-2026-42055
- CVE-2026-48142
- CVE-2026-42533
- CVE-2026-56434

Each fix was selected from the upstream commits referenced by
the corresponding nginx security advisory.

The series also adds conditional CVE_STATUS entries for
CVE-2026-40460 and CVE-2026-60005. These are not applicable
when the HTTP/3 and slice modules, respectively, are disabled.
They remain reported as unpatched when those modules are enabled.

Validation performed:

 - The complete series applies cleanly to the Wrynose branch.
 - bitbake nginx -c patch -f completed successfully.
 - bitbake core-image-minimal completed successfully.

Hetvi Thakar (11):
  nginx: Fix CVE-2026-40701
  nginx: fix CVE-2026-42934
  nginx: fix CVE-2026-42946
  nginx: fix CVE-2026-42945
  nginx: fix CVE-2026-9256
  nginx: fix CVE-2026-42055
  nginx: fix CVE-2026-48142
  nginx: fix CVE-2026-42533
  nginx: fix CVE-2026-56434
  nginx: Ignore CVE-2026-40460
  nginx: Ignore CVE-2026-60005

 .../nginx/files/CVE-2026-40701.patch          |  74 ++
 .../nginx/files/CVE-2026-42533_p1.patch       | 127 +++
 .../nginx/files/CVE-2026-42533_p2.patch       | 381 +++++++++
 .../nginx/files/CVE-2026-42533_p3.patch       | 704 +++++++++++++++++
 .../nginx/files/CVE-2026-42533_p5.patch       | 254 ++++++
 .../nginx/files/CVE-2026-42934.patch          |  80 ++
 .../nginx/files/CVE-2026-42945.patch          |  47 ++
 .../nginx/files/CVE-2026-42946_p1.patch       |  47 ++
 .../nginx/files/CVE-2026-42946_p2.patch       |  92 +++
 .../nginx/files/CVE-2026-48142.patch          |  42 +
 .../nginx/files/CVE-2026-56434.patch          |  71 ++
 .../nginx/files/CVE-2026-9256.patch           |  77 ++
 .../nginx/nginx-1.28.3/CVE-2026-42055.patch   | 108 +++
 .../nginx-1.28.3/CVE-2026-42533_p4.patch      | 587 ++++++++++++++
 .../nginx/nginx-1.29.7/CVE-2026-42055.patch   | 188 +++++
 .../nginx-1.29.7/CVE-2026-42533_p4.patch      | 723 ++++++++++++++++++
 .../recipes-httpd/nginx/nginx_1.28.3.bb       |  19 +
 .../recipes-httpd/nginx/nginx_1.29.7.bb       |  19 +
 18 files changed, 3640 insertions(+)
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-40701.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p1.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p2.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p3.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p5.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42934.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42945.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p1.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p2.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-48142.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-56434.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-9256.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42533_p4.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42533_p4.patch