diff mbox series

[meta-webserver,wrynose,10/11] nginx: Ignore CVE-2026-40460

Message ID 20261016032056.409095-11-hthakar@cisco.com
State New
Headers show
Series nginx: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 3:20 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2026-40460 affects nginx only when the HTTP/3
  QUIC module is enabled [1].
- The module requires the explicit --with-http_v3_module configure
  option, which neither Wrynose nginx recipe enables by default [2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://nginx.org/en/security_advisories.html
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb | 1 +
 meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb | 1 +
 2 files changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
index 56050b84eb..ca8e7129fb 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
@@ -23,3 +23,4 @@  SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee
 
 CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1"
 CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2"
+CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
index 68015a12fa..2aae2091a0 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
@@ -25,3 +25,4 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99"
 
 SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139"
 
+CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"