new file mode 100644
@@ -0,0 +1,52 @@
+From 49c1c89136d3b1a0f6c1c2d645a7ceaf78efbf70 Mon Sep 17 00:00:00 2001
+From: Pavel Pautov <p.pautov@f5.com>
+Date: Fri, 15 May 2026 00:48:50 -0700
+Subject: [PATCH] Fixed uninitialized memory read caused by stale regex
+ captures.
+
+When ngx_http_regex_exec() reallocates r->captures array, it doesn't update
+r->ncaptures value, if regex didn't match. So the next use of unnamed regex
+capture triggers uninitialized read and potential buffer overrun.
+
+This config demonstrates the issue:
+ map test $my_map {
+ volatile;
+
+ ~mismatch(.*) 1; # reallocates r->captures in subrequests
+
+ default "";
+ }
+
+ server {
+ location ~(.*) { # sets r->ncaptures
+ slice 50;
+
+ # $1 will read from uninitialized memory in slice subrequests
+ proxy_set_header Test $my_map$1;
+
+ proxy_set_header Range $slice_range;
+ proxy_pass http://backend;
+ }
+ }
+
+The issue was introduced by 746fba0d79c6.
+
+CVE: CVE-2026-42533
+Upstream-Status: Backport [https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336]
+Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
+---
+ src/http/ngx_http_variables.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
+index 16ffda3fe..47d78482b 100644
+--- a/src/http/ngx_http_variables.c
++++ b/src/http/ngx_http_variables.c
+@@ -2624,6 +2624,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
+
+ if (r->captures == NULL || r->realloc_captures) {
+ r->realloc_captures = 0;
++ r->ncaptures = 0;
+
+ r->captures = ngx_palloc(r->pool, len * sizeof(int));
+ if (r->captures == NULL) {
@@ -29,6 +29,7 @@ SRC_URI = " \
file://CVE-2025-23419.patch \
file://CVE-2026-1642.patch \
file://CVE-2026-27784.patch \
+ file://CVE-2026-42533.patch \
"
inherit siteinfo update-rc.d useradd systemd
This fix was made available with v1.30.4 [1] version of nginx: https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336 and the CVE is further described here: https://nvd.nist.gov/vuln/detail/CVE-2026-42533 [1]: https://github.com/nginx/nginx/releases/tag/release-1.30.4 Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com> --- .../nginx/files/CVE-2026-42533.patch | 52 +++++++++++++++++++ meta-webserver/recipes-httpd/nginx/nginx.inc | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533.patch