mbox series

[meta-webserver,wrynose,0/3] nginx: Security Fix

Message ID 20261103070429.1299769-1-hthakar@cisco.com
Headers show
Series nginx: Security Fix | expand

Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 3, 2026, 7:04 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This series addresses CVE-2026-95101, CVE-2026-97629, and CVE-2026-15176 in the Wrynose nginx 1.28.3 and 1.29.7 recipes. 
The patches backport upstream fixes for HTTP/3 request-body injection, shared SSL session ticket key synchronization, 
and unsafe alias-based path mapping after URI rewrites.

The series is based on the eleven Nginx patches already submitted to meta-openembedded and still under review:
https://patchwork.yoctoproject.org/project/oe/cover/20261016032056.409095-1-hthakar%40cisco.com/

Those eleven patches are prerequisites; they are not included or resent in this three-patch series.

Validation: BitBake do_patch and do_compile and image build completed successfully.

Hetvi Thakar (3):
  nginx: fix CVE-2026-95101
  nginx: fix CVE-2026-97629
  nginx: fix CVE-2026-15176

 .../nginx/files/CVE-2026-15176.patch          | 55 +++++++++++++++
 .../nginx/files/CVE-2026-95101.patch          | 69 +++++++++++++++++++
 .../nginx/files/CVE-2026-97629.patch          | 46 +++++++++++++
 .../recipes-httpd/nginx/nginx_1.28.3.bb       |  3 +
 .../recipes-httpd/nginx/nginx_1.29.7.bb       |  3 +
 5 files changed, 176 insertions(+)
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-15176.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-95101.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-97629.patch