From patchwork Fri Oct 16 03:20:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100930 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3FFE1CC6B2D for ; Fri, 16 Oct 2026 03:21:02 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14025.1792120857867434225 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hCXpn4JD; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4246; q=dns/txt; s=iport01; t=1792120857; x=1793330457; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=lZi2va1aVWpQB35e4AjRGFWtOGPKXe7UyQ5Ex7mSkYg=; b=hCXpn4JDz3MoalRRZ2pQcc5ZLNFvrvvJlWNO96ssEhNdHv7JZuFScT8R GGI7dqy+3cKwjUu4+Pw30L/zjVou/UD4+F0gPyQiVehy7CS4mzAnJxSVX c6BM4ri1Fmk5Rrndr/BrSt7WJsyzPIzE0kIcXasNH7WM11/xiR29affg5 GYJddn6Ae39aFTF7dwL9LTf2r4S1ZxpAEfmjKvLOwxie/+OCkl1Kd+PEq yspzdOL79VbZiynFzqbrj2QU3JazFXJgSG36EQ3KRfDvIV0YY9+Z77L7S tMzLCHbYmtuIGq40cFBoji0mVqhI+oIAtmI9JpwTFMOxIEC5sqAWQEDEs g==; X-CSE-ConnectionGUID: 61pNy04lTB6fBjuW7wTKcw== X-CSE-MsgGUID: GgtQ3RqxRxev3qRbZjtSaQ== X-IPAS-Result: A0CmAgCRl9Fq/4z/Ja1aglmCGD91YENJA41XiARsA54cgX4PAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYIqWAGCdAMRBrx0gXkzgQGDKQGBVNsyAQsUAQWBM4VAiCNdGAGEfCcbG4FygRWDaYEFgVwBAQGIJASCIoEMgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5ITHoJlPVEBExYCgWsYBQKTUJJHgTWfWgoog3aMIpU6GjOqbwuYfY4Klg1ChGmBaDyBWXAVgyIJShkPji8KC4NghRPJRycyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:+ZOO16i/stdR0knrzlMmg95GX161MREKZh0ujC45NGQN5FlHY01je htvDWCOOvfeMDT8KIgiPIngoBlTvsOEzNdjQVBtqiFkQyhjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqVGo/5REDkS8 cAydj4nbA282P2K47mkH7wEasQLdKEHPasFsX1miDWcBvE8TNWbGOPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg9/5JEWxI9EglH/bz1Rq1uPjaE2+GPUigd21dABNfKIIYLTGZ4JwxbwS mTu0GvlO0ogLcyl2TebqWuWjN3NgRjyYddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7V99BJ kg8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmUHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:jSpu/KoT/7Y03MPGM6CZ4ZEaV5rzeYIsimQD101hICG9vPb2qy nIpoV96faaslcssR0b9OxofZPwI080lqQFhbX5Q43DYOCOggLBR+tfBMnZsljd8kbFmNK1u5 0NT0FWMqyXMbEDt7eY3CCIV/A93dKA7Kekwc3az3trUEVWTpsI1XYBNu5eeXcGPzWvwvECZe Kh2vY= X-Talos-CUID: 9a23:7whW7mHZWo6gatwFqmI5rVYyC5h5dkH3knn6IVKHVnlVa7aKHAo= X-Talos-MUID: 9a23:wODRtg1Qxfwk6g4ZBhGVsM22LDUjzKuyMRs3iIU8q8SabjVKMQWfkA++e9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536143458" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id CE0DD18000616; Fri, 16 Oct 2026 03:20:56 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 75D47CBF201; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 01/11] nginx: Fix CVE-2026-40701 Date: Thu, 15 Oct 2026 20:20:46 -0700 Message-Id: <20261016032056.409095-2-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131024 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/d2b8d47741820c9fb134c6731ecb40b21f3085b1 [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-40701.patch | 74 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 4 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 4 + 3 files changed, 82 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-40701.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-40701.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-40701.patch new file mode 100644 index 0000000000..23de07d87d --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-40701.patch @@ -0,0 +1,74 @@ +From d2b8d47741820c9fb134c6731ecb40b21f3085b1 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Tue, 21 Apr 2026 14:51:41 +0400 +Subject: [PATCH] OCSP: resolve cleanup on connection close + +Previously, when a client SSL connection was terminated (typically due to a +timeout) while resolving an OCSP responder, the OCSP context was freed, but +the resolve context was not. This resulted in use-after-free on resolve +completion. + +Reported by Leo Lin. + +CVE: CVE-2026-40701 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/d2b8d47741820c9fb134c6731ecb40b21f3085b1] + +(cherry picked from commit d2b8d47741820c9fb134c6731ecb40b21f3085b1) +Signed-off-by: Hetvi Thakar +--- + src/event/ngx_event_openssl_stapling.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c +index a0a8031c7..231bdeceb 100644 +--- a/src/event/ngx_event_openssl_stapling.c ++++ b/src/event/ngx_event_openssl_stapling.c +@@ -113,6 +113,7 @@ struct ngx_ssl_ocsp_ctx_s { + + ngx_resolver_t *resolver; + ngx_msec_t resolver_timeout; ++ ngx_resolver_ctx_t *resolve; + + ngx_msec_t timeout; + +@@ -1341,6 +1342,10 @@ ngx_ssl_ocsp_done(ngx_ssl_ocsp_ctx_t *ctx) + ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0, + "ssl ocsp done"); + ++ if (ctx->resolve) { ++ ngx_resolve_name_done(ctx->resolve); ++ } ++ + if (ctx->peer.connection) { + ngx_close_connection(ctx->peer.connection); + } +@@ -1433,7 +1438,10 @@ ngx_ssl_ocsp_request(ngx_ssl_ocsp_ctx_t *ctx) + resolve->data = ctx; + resolve->timeout = ctx->resolver_timeout; + ++ ctx->resolve = resolve; ++ + if (ngx_resolve_name(resolve) != NGX_OK) { ++ ctx->resolve = NULL; + ngx_ssl_ocsp_error(ctx); + return; + } +@@ -1522,6 +1530,7 @@ ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve) + } + + ngx_resolve_name_done(resolve); ++ ctx->resolve = NULL; + + ngx_ssl_ocsp_connect(ctx); + return; +@@ -1529,6 +1538,8 @@ ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve) + failed: + + ngx_resolve_name_done(resolve); ++ ctx->resolve = NULL; ++ + ngx_ssl_ocsp_error(ctx); + } + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index f797f4a289..25493be747 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -1,5 +1,9 @@ require nginx.inc +SRC_URI:append = " \ + file://CVE-2026-40701.patch \ +" + LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee91a918" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 4d884fcbb3..c8881a320e 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -1,5 +1,9 @@ require nginx.inc +SRC_URI:append = " \ + file://CVE-2026-40701.patch \ +" + # 1.28.x branch is the current stable branch, the recommended default # 1.29.x is the current mainline branches containing all new features DEFAULT_PREFERENCE = "-1" From patchwork Fri Oct 16 03:20:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100932 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95B83CCA46D for ; Fri, 16 Oct 2026 03:21:03 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13829.1792120857841685084 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=PauoYPJp; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4586; q=dns/txt; s=iport01; t=1792120858; x=1793330458; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=slGCACfh5mbyp01uZccU+kDlq3gFL8bRLsQ4J/QbOjc=; b=PauoYPJpH9wgkyJouFXXiDrImtwemItcDfNbxuEb8X7TK9kGCOhR4/ay vkhIwJ4ekBPh+EWxS2tEdu65eB06Buoz5C3j6mk0U3hFpWadu+in4E/v5 /KC8xROg+nfrfz1m/ujEKCf4Ng1qv9Jf2lYSkI9/xAQvgUy/2X9kwQrsN 32C7fRPDJxsgvRmEdDszn1gaNT/hy9RazKZvrjfikA9eOr4dw+HwiVGMU UUciedzB7FQJQrP/JRK2mOTDI+ePxfW9m7dK8L4dLqK/qQardZTqkskeS LAwmReHF+uhbKtLQXiyNp101hzE9E2kK4KL9j8x+tg61GbQnuFElRI5d9 g==; X-CSE-ConnectionGUID: +kyccNshTBqdSjuF65Yn/w== X-CSE-MsgGUID: x/kZ34XRRm2c9aMT+NfLgA== X-IPAS-Result: A0C+AgBtltFq/4v/Ja1aHgEBCxIMggULgld1YENJA41XiARsA4ETilKSN4F+DwEBAQ9EDQQBAYUFAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLyALIwgZgwIBgjoDNwMRBrxzgXkzgQGDKQGBVNhLDYJaAQsUAQWBM4VAgn+FJF0YAYR8JxsbgXKBFYJzdoEFgRpCAQEBiCQEgiKBDIFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSEx6CZRYbDFEBKQEBgWsYk2AIkjagHnEKKIN2jCKPPoV8GjOEBJQXklQLmH2OCoQJkkaEaYFoPIFZcBWDIglKGQ+OKwQKC4NghRPJRycyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:wq8iNaNKfqzs4brvrR30lsFynXyQoLVcMsEvi/4bfWQNrUp20TJTy mJKCmyOb/yLYzehc9t0aYjn9xgD7ZXWxtUyGXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb9gmAsawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj67ZtHUo9G5YYxsxuDVpM6 NJGdQELKQ/W0opawJrjIgVtrt4oIM+uOMYUvWttiGmDS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2M0PXwsYDUXUrsTIJIinO6rj2PXeDxDo1XTrq0yi4TW5FEriemzb4eKKrRmQ+1F2UWq/ T72xV78WBpLPfmjihyL1n2F07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR63rOe0jma6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MuUCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXPIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:HMtJyaxWkUHBI9RzV+oyKrPw9L1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICPcqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIWpIObuEYdWIK7vrS0U2fD8sqxsWB/eSDgOfTyGoocCRRApsQljuQzm2gYzZLrM4sP+tAKK ah X-Talos-CUID: 9a23:0pLXyG1io7a72Vtmafp0brxfWcM0eXb713fsCVa0MmR0ZuPIeFnX5/Yx X-Talos-MUID: 9a23:kywYEAvGYiETfTlPGs2nlHZhBpw0056UDRoGwJwjh4qiOwh/EmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="521967578" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id D19BD180000F5; Fri, 16 Oct 2026 03:20:56 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 794E9CBF202; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 02/11] nginx: fix CVE-2026-42934 Date: Thu, 15 Oct 2026 20:20:47 -0700 Message-Id: <20261016032056.409095-3-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131030 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/54b7945961b2eaafc480d6b85d9635d0db1c126a [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-42934.patch | 80 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 3 files changed, 82 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42934.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42934.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42934.patch new file mode 100644 index 0000000000..5ae96e8372 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42934.patch @@ -0,0 +1,80 @@ +From 54b7945961b2eaafc480d6b85d9635d0db1c126a Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sun, 12 Apr 2026 07:13:23 +0100 +Subject: [PATCH] Charset: fix buffer over-read in recode_from_utf8(). + +When a multi-byte UTF-8 character was split across 3+ single-byte +buffers, the saved bytes continuation path had two related bugs: + +ngx_utf8_decode() was called with the last saved-array index instead +of the byte count, causing it to report "incomplete" even when the +sequence was already complete. + +The subsequent ngx_memcpy() used that same index as the copy length, +reading past the input buffer boundary. + +CVE: CVE-2026-42934 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/54b7945961b2eaafc480d6b85d9635d0db1c126a] + +(cherry picked from commit 54b7945961b2eaafc480d6b85d9635d0db1c126a) +Signed-off-by: Hetvi Thakar +--- + .../modules/ngx_http_charset_filter_module.c | 20 ++++++------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c +index 482960040..edb2db568 100644 +--- a/src/http/modules/ngx_http_charset_filter_module.c ++++ b/src/http/modules/ngx_http_charset_filter_module.c +@@ -689,7 +689,6 @@ ngx_http_charset_recode_from_utf8(ngx_pool_t *pool, ngx_buf_t *buf, + u_char c, *p, *src, *dst, *saved, **table; + uint32_t n; + ngx_buf_t *b; +- ngx_uint_t i; + ngx_chain_t *out, *cl, **ll; + + src = buf->pos; +@@ -783,18 +782,12 @@ ngx_http_charset_recode_from_utf8(ngx_pool_t *pool, ngx_buf_t *buf, + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, pool->log, 0, + "http charset utf saved: %z", ctx->saved_len); + +- p = src; +- +- for (i = ctx->saved_len; i < NGX_UTF_LEN; i++) { +- ctx->saved[i] = *p++; +- +- if (p == buf->last) { +- break; +- } +- } ++ len = ngx_min(NGX_UTF_LEN - ctx->saved_len, (size_t) (buf->last - src)); ++ ngx_memcpy(&ctx->saved[ctx->saved_len], src, len); ++ len += ctx->saved_len; + + saved = ctx->saved; +- n = ngx_utf8_decode(&saved, i); ++ n = ngx_utf8_decode(&saved, len); + + c = '\0'; + +@@ -810,7 +803,7 @@ ngx_http_charset_recode_from_utf8(ngx_pool_t *pool, ngx_buf_t *buf, + + /* incomplete UTF-8 symbol */ + +- if (i < NGX_UTF_LEN) { ++ if (len < NGX_UTF_LEN) { + out = ngx_http_charset_get_buf(pool, ctx); + if (out == NULL) { + return NULL; +@@ -823,8 +816,7 @@ ngx_http_charset_recode_from_utf8(ngx_pool_t *pool, ngx_buf_t *buf, + b->sync = 1; + b->shadow = buf; + +- ngx_memcpy(&ctx->saved[ctx->saved_len], src, i); +- ctx->saved_len += i; ++ ctx->saved_len = len; + + return out; + } +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 25493be747..25d8784c48 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -2,6 +2,7 @@ require nginx.inc SRC_URI:append = " \ file://CVE-2026-40701.patch \ + file://CVE-2026-42934.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index c8881a320e..ae7bfaee9f 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -2,6 +2,7 @@ require nginx.inc SRC_URI:append = " \ file://CVE-2026-40701.patch \ + file://CVE-2026-42934.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100937 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20BEBCCF2C1 for ; Fri, 16 Oct 2026 03:21:04 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13832.1792120861021132594 for ; Thu, 15 Oct 2026 20:21:01 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=GabRYUBh; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7546; q=dns/txt; s=iport01; t=1792120861; x=1793330461; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=P9rldBZq6qbUNCKgDfq75W+G4qRnBhveNa6IwJ4wUT8=; b=GabRYUBhiovpuD9Cno1frLONWPiIl1O8Gpree2RNlB9lnhD+2E1AdzOm E2R3axIhErE4SXa0B47wlxLqWoM9/XHnFSjOS1U/FsvXx9ydrzpYtXgfa MA8Pj/50cBOwiSaR1AGydFThwZtaZNZiDp+25AvMvm1ni0twXxtnakCG7 vMi6KCUs6U72EfDzYj6tBi4wzQCjgUBet0n+KvQR0EQBjpXC+eHR+Z/Q0 2/FIS8Wjt8AvyD4D4dPtkQeEK2V3/3fJdPrWqEd5zPuNFJi7H0oLMkI/+ xcBXWJuS4qAIgpUcQbGHRJcg/L6Wmz1XynuMUD4pSRP69kNhuHjZ258fM A==; X-CSE-ConnectionGUID: TiiSp/3nR/G5bSvKrwt8ag== X-CSE-MsgGUID: 5TWC0kC9TsWSJ3XJiFv4Kw== X-IPAS-Result: A0CmAgCRl9Fq/4v/Ja1aglmCV3VgQ0kDjVeIBGwDnhwUgWoPAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxEGvHSBeTOBAYMpAYFU2zIBCxQBBYEzhUCII10YAYR8JxsbgXKEfoEFgVwBAQGBRoZeBIIigQyBWo4khyNIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSEx6CZAE9UQEpAQEXgVQYph6hDwoog3aMIpU6GjOqbwuYfY4Klk+EaYFoPIFZcBWDIglKGQ+OLwoLg2CFE8lHJzICCQMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:M1c8F6zkRIetkFMWe9V6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkUCz WcYCmuGM6mDYWb8L4p3O4rj9ksH68eDn9ZkSldo+1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJH03PLYAvb1xOyZhq PYjNhMXcQzTju3jldpXSsE07igiBNPgMIVavjRryivUSK58B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2bMnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OW3YIKMKo3WFa25mG7Fm l3tp2fSUy0BC+e9kgqn81yy2szQyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rAnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:oLNRqqopTwy0NaiXzMWxPVAaV5rzeYIsimQD101hICG9vPb2qy nIpoV96faaslcssR0b9OxofZPwI080lqQFhbX5Q43DYOCOggLBR+tfBMnZsljd8kbFmNK1u5 0NT0FWMqyXMbEDt7eY3CCIV/A93dKA7Kekwc3az3trUEVWTpsI1XYBNu5eeXcGPzWvwvECZe Kh2vY= X-Talos-CUID: 9a23:b26y4mqIr1R9npcP+bMQb2LmUfwkc0bFiyzWGQiXVGxSVp6PVkPA8awxxg== X-Talos-MUID: 9a23:OZoXEwmZwtIwOqEzLP42dno/CPhDu6eFWXwWrq4k4PmmNAJuZxSC2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528018948" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id D345D1800023D; Fri, 16 Oct 2026 03:20:56 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 7CDBBCBF203; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 03/11] nginx: fix CVE-2026-42946 Date: Thu, 15 Oct 2026 20:20:48 -0700 Message-Id: <20261016032056.409095-4-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131034 From: Hetvi Thakar These patches apply the upstream fix sequence as referenced in [3], using the commits shown in [1] and [2]. [1] https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e [2] https://github.com/nginx/nginx/commit/39d7d0ba0799fcff6baee52b6525f45739593cfd [3] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-42946_p1.patch | 47 ++++++++++ .../nginx/files/CVE-2026-42946_p2.patch | 92 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 2 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 2 + 4 files changed, 143 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p1.patch create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p2.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p1.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p1.patch new file mode 100644 index 0000000000..68f7627ef5 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p1.patch @@ -0,0 +1,47 @@ +From baef7fdac28e4e1fe26509b50b8d15603393e28e Mon Sep 17 00:00:00 2001 +From: Sergey Kandaurov +Date: Wed, 29 Apr 2026 21:56:51 +0400 +Subject: [PATCH] Upstream: reset parsing state after invalid status line + +Previously, it was possible to start parsing headers with a wrong +parsing state after status line was not recognized, as a fallback +used in the scgi and uwsgi modules. + +Reported by Leo Lin. + +CVE: CVE-2026-42946 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e] + +(cherry picked from commit baef7fdac28e4e1fe26509b50b8d15603393e28e) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_scgi_module.c | 1 + + src/http/modules/ngx_http_uwsgi_module.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c +index 49977b07b..038380798 100644 +--- a/src/http/modules/ngx_http_scgi_module.c ++++ b/src/http/modules/ngx_http_scgi_module.c +@@ -1029,6 +1029,7 @@ ngx_http_scgi_process_status_line(ngx_http_request_t *r) + + if (rc == NGX_ERROR) { + u->process_header = ngx_http_scgi_process_header; ++ r->state = 0; + return ngx_http_scgi_process_header(r); + } + +diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c +index c1d0035cc..05c08b6c4 100644 +--- a/src/http/modules/ngx_http_uwsgi_module.c ++++ b/src/http/modules/ngx_http_uwsgi_module.c +@@ -1266,6 +1266,7 @@ ngx_http_uwsgi_process_status_line(ngx_http_request_t *r) + + if (rc == NGX_ERROR) { + u->process_header = ngx_http_uwsgi_process_header; ++ r->state = 0; + return ngx_http_uwsgi_process_header(r); + } + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p2.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p2.patch new file mode 100644 index 0000000000..1f25ebab15 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42946_p2.patch @@ -0,0 +1,92 @@ +From 39d7d0ba0799fcff6baee52b6525f45739593cfd Mon Sep 17 00:00:00 2001 +From: Sergey Kandaurov +Date: Wed, 29 Apr 2026 23:02:20 +0400 +Subject: [PATCH] Upstream: fixed parsing of split status lines + +If the first response line was split across reads and it didn't appear +a status line, the portion already processed was lost. To preserve ABI, +the change reuses r->header_name_start for proper backtracking on status +line fallback. + +CVE: CVE-2026-42946 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/39d7d0ba0799fcff6baee52b6525f45739593cfd] + +(cherry picked from commit 39d7d0ba0799fcff6baee52b6525f45739593cfd) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_proxy_module.c | 5 +++++ + src/http/modules/ngx_http_scgi_module.c | 5 +++++ + src/http/modules/ngx_http_uwsgi_module.c | 5 +++++ + 3 files changed, 15 insertions(+) + +diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c +index 0778ec728..454ef6270 100644 +--- a/src/http/modules/ngx_http_proxy_module.c ++++ b/src/http/modules/ngx_http_proxy_module.c +@@ -1835,6 +1835,10 @@ ngx_http_proxy_process_status_line(ngx_http_request_t *r) + + u = r->upstream; + ++ if (r->state == 0) { ++ r->header_name_start = u->buffer.pos; ++ } ++ + rc = ngx_http_parse_status_line(r, &u->buffer, &ctx->status); + + if (rc == NGX_AGAIN) { +@@ -1842,6 +1846,7 @@ ngx_http_proxy_process_status_line(ngx_http_request_t *r) + } + + if (rc == NGX_ERROR) { ++ u->buffer.pos = r->header_name_start; + + #if (NGX_HTTP_CACHE) + +diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c +index 038380798..7477df317 100644 +--- a/src/http/modules/ngx_http_scgi_module.c ++++ b/src/http/modules/ngx_http_scgi_module.c +@@ -1021,6 +1021,10 @@ ngx_http_scgi_process_status_line(ngx_http_request_t *r) + + u = r->upstream; + ++ if (r->state == 0) { ++ r->header_name_start = u->buffer.pos; ++ } ++ + rc = ngx_http_parse_status_line(r, &u->buffer, status); + + if (rc == NGX_AGAIN) { +@@ -1029,6 +1033,7 @@ ngx_http_scgi_process_status_line(ngx_http_request_t *r) + + if (rc == NGX_ERROR) { + u->process_header = ngx_http_scgi_process_header; ++ u->buffer.pos = r->header_name_start; + r->state = 0; + return ngx_http_scgi_process_header(r); + } +diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c +index 05c08b6c4..d012f4fd4 100644 +--- a/src/http/modules/ngx_http_uwsgi_module.c ++++ b/src/http/modules/ngx_http_uwsgi_module.c +@@ -1258,6 +1258,10 @@ ngx_http_uwsgi_process_status_line(ngx_http_request_t *r) + + u = r->upstream; + ++ if (r->state == 0) { ++ r->header_name_start = u->buffer.pos; ++ } ++ + rc = ngx_http_parse_status_line(r, &u->buffer, status); + + if (rc == NGX_AGAIN) { +@@ -1266,6 +1270,7 @@ ngx_http_uwsgi_process_status_line(ngx_http_request_t *r) + + if (rc == NGX_ERROR) { + u->process_header = ngx_http_uwsgi_process_header; ++ u->buffer.pos = r->header_name_start; + r->state = 0; + return ngx_http_uwsgi_process_header(r); + } +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 25d8784c48..0d6996adfc 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -3,6 +3,8 @@ require nginx.inc SRC_URI:append = " \ file://CVE-2026-40701.patch \ file://CVE-2026-42934.patch \ + file://CVE-2026-42946_p1.patch \ + file://CVE-2026-42946_p2.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index ae7bfaee9f..9867ebea3d 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -3,6 +3,8 @@ require nginx.inc SRC_URI:append = " \ file://CVE-2026-40701.patch \ file://CVE-2026-42934.patch \ + file://CVE-2026-42946_p1.patch \ + file://CVE-2026-42946_p2.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100935 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C24AECCA48B for ; Fri, 16 Oct 2026 03:21:03 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14024.1792120857866428002 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=EN8kwwBD; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3554; q=dns/txt; s=iport01; t=1792120857; x=1793330457; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ck2UzoshakPePwKTGxiILBsUhnFkP/W7vv4WPff9n7M=; b=EN8kwwBDLbSPt0urbuw7W09NGdvW46M9C9Zhl0fxoQJVnLAQ4PXw4iKL MZoNoQGtWRPrMZp9sEbo7qnwsqUth0KuL5CYoV2Gb990k4zbvQtz3diL+ 1AT2wLVA+0YwL1cz7lzNWuDx8cgx4MNRw6hWYiHLAEhihwxMETf5fjm3o dcaEjEjF+/hW265TDzbagZDsJ66xbXk5BnHsg//zuKxTWNXJiBuRTPFAF 2Q3rYGTjwlWqQ7ZPwrbFmM5XqByRsX/SGGR3VKgIR74slBh2LxE3G0ewp WKuIP/ScgQzjvhSpBqyQId+JVpUQ+RPuvb71HeWT/Ap2Gw1QrNph1PrYr Q==; X-CSE-ConnectionGUID: IMkHhEb3Th+my7PtDh5XGA== X-CSE-MsgGUID: oF/Ng0iGT4qMMUcxcg8I/w== X-IPAS-Result: A0CmAgCRl9Fq/4r/Ja1aglmCV3VgQ0kDjVeIBGwDnhyBfg8BAQEPRA0EAQGFBQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEQa8dIF5M4EBgykBgVTbMgELFAEFgTOFQIgjXRgBhHwnGxuBcoR+gQWBXAEBAYgkBIIigQyBWh4ylHdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSEx6CZT1RASkBASCBQAumNqEPCiiDdowilToaM6pvC5h9jgqVZhlQhGmBaDyBWXAVgyIJShkPji8KC4NghRPJRycyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:axUuiK01kXDoyihB5/bD5YJwkn2cJEfYwER7XKvMYLTBsI5bp2YBz moeCGuDPP7fMzb1edwnPoXn9k8OsMDVmtA2TAY53Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGLWQ1HY018L1LASJL5 KMgNBwNMyCsrrfjqF67YrEEasULNsLnOsYb/3pn1zycVa9gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNU+QC/FMEg9/5JYWnPuoj3r2aRVTqUmeouw85G27IAlZjeOzboWMIoLVLSlTtkG24 UTJp2XWPk0DEfmiwiqO/SKNwfCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7AQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:ero/MKBVz2gwHSnlHel055DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygd179 YHT0EHMqySMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ASV0mlhD0JcTpy1SZNNXF7OaY= X-Talos-CUID: 9a23:Dw9cnGHiFS0AJAUEqmJG0U00Gu0vKUHdj3LBfHekJWY0eJK8HAo= X-Talos-MUID: 9a23:qj2YHwZTWLz8oeBTsBGroj46NehUv72LLX0GgZ4J6+jDKnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536671067" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id D77FB180001DB; Fri, 16 Oct 2026 03:20:56 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 80481CBF204; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 04/11] nginx: fix CVE-2026-42945 Date: Thu, 15 Oct 2026 20:20:49 -0700 Message-Id: <20261016032056.409095-5-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131025 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/524977e7c534e87e5b55739fa74601c9f1102686 [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-42945.patch | 47 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 3 files changed, 49 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42945.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42945.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42945.patch new file mode 100644 index 0000000000..df26fd79dc --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42945.patch @@ -0,0 +1,47 @@ +From 524977e7c534e87e5b55739fa74601c9f1102686 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Wed, 22 Apr 2026 09:39:31 +0400 +Subject: [PATCH] Rewrite: fixed escaping and possible buffer overrun + +The following code resulted in incorrect escaping of $1 and possible +segfault: + + location / { + rewrite ^(.*) /new?c=1; + set $myvar $1; + return 200 $myvar; + } + +If there were arguments in a rewrite's replacement string, the is_args flag +was set and incorrectly never cleared. This resulted in escaping applied +to any captures evaluated afterwards in set or if. Additionally buffer was +allocated by ngx_http_script_complex_value_code() without escaping expected, +thus this also resulted in buffer overrun and possible segfault. + +A similar issue was fixed in 74d939974d43. + +Reported by Leo Lin. + +CVE: CVE-2026-42945 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/524977e7c534e87e5b55739fa74601c9f1102686] + +(cherry picked from commit 524977e7c534e87e5b55739fa74601c9f1102686) +Signed-off-by: Hetvi Thakar +--- + src/http/ngx_http_script.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c +index a2b9f1b7b..2ea611373 100644 +--- a/src/http/ngx_http_script.c ++++ b/src/http/ngx_http_script.c +@@ -1202,6 +1202,7 @@ ngx_http_script_regex_end_code(ngx_http_script_engine_t *e) + + r = e->request; + ++ e->is_args = 0; + e->quote = 0; + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 0d6996adfc..308edd96bd 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -5,6 +5,7 @@ SRC_URI:append = " \ file://CVE-2026-42934.patch \ file://CVE-2026-42946_p1.patch \ file://CVE-2026-42946_p2.patch \ + file://CVE-2026-42945.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 9867ebea3d..4a3d524346 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -5,6 +5,7 @@ SRC_URI:append = " \ file://CVE-2026-42934.patch \ file://CVE-2026-42946_p1.patch \ file://CVE-2026-42946_p2.patch \ + file://CVE-2026-42945.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100933 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B75CDCCA473 for ; Fri, 16 Oct 2026 03:21:03 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14027.1792120858265249906 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=g8VHR4lo; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4379; q=dns/txt; s=iport01; t=1792120858; x=1793330458; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=pRJxJ4H/vCKzUhCly9cVEXCgZwDlF6+zKEPcLZmlJRo=; b=g8VHR4loD41VPGQ0F9UUNL5hUPl5KxXHQWucLAn2pyXHfdRksnic2GSX QoDlFoXd8GSBp9QE1tXtMkb1308LTmSCwhJ/0ukP4GpOvLt2aEEvJPKrg T2pm8dAQj0nexQyQ90g/AvdpnKQhz3HMstNkMl4SpwKEStWKNQN3va0Hr ejemIaqamXcrF8xT/gHk4LxxNzA8gD0lUqx/4T8pWyqJ0RWu6cCYRrKz9 5yqsZdhtRk3b0BOAl7kEMrf1pN2Cn9Kuenk0l1lI9ATplawiLNtD34xKC 9fU3cuLv5t2A99nDD8A+dT/oppPzIxR2/OfOy+jYyqsNVaH1YY9EQntTi g==; X-CSE-ConnectionGUID: tsFgxTF9RQGqORjg90qE5g== X-CSE-MsgGUID: XFyX6UdzT6qb8AMfyaaZEg== X-IPAS-Result: A0CoAgCRl9Fq/4r/Ja1aglmCV3VgQ0kDjVeIBGwDgx2af4F+DwEBAQ9EDQQBAYQwVQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEZLRAcAgEBAi8kByMIGYMCAYJxAwMRAwO8dIF5M4EBgyqBVNsyAQsUAQWBM4Fzg02II10YAYR8JxsbgXKBFYNpgQVNgQ8BAQEBiCMEgiKBDIFaHjKUd0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5ITHoJlPVEBKQEBgWumNqEPCiiDdowilToaM6pvmQiOCoJuhhWNTIRpgWg8gVlwFYMiCUoZD44uAQoLg2CFE8lHJzICCQMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:B2H4wawQiw7pE5m6ull6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkUDm DcaXm2Oa/6Ka2XxL40lOtix904HuJTVmNZgTwZsrFhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJF0tE4IIxsgmO1hh7 NsiKj9cNgmu2u3jldpXSsE07igiBNPgMIVavjRryivUSK5/B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2bM3WjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OW2boaOIILTG625mG6oi HP2oVn1EC1ELdbP4B+L43ultMLAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:2aoiJ6ndkCs9k9c8kujTNPHd0RLpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:y4FylWmNahz6ZYfPdbDPj2ZHYBnXOWHG4njAH2HpM19GUZqvS1DBoLpJzsU7zg== X-Talos-MUID: 9a23:YaLgtQZme/BZGuBThxH9tG9fONVUvb2kWGkon4QPsvupOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536432616" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 37E71180001DB; Fri, 16 Oct 2026 03:20:57 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 83DF2CBF21E; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 05/11] nginx: fix CVE-2026-9256 Date: Thu, 15 Oct 2026 20:20:50 -0700 Message-Id: <20261016032056.409095-6-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131031 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/3f135ae2eb60ce376196c898a6c7cb4d774f7068 [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-9256.patch | 77 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 3 files changed, 79 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-9256.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-9256.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-9256.patch new file mode 100644 index 0000000000..7ffa188abf --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-9256.patch @@ -0,0 +1,77 @@ +From 3f135ae2eb60ce376196c898a6c7cb4d774f7068 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Thu, 14 May 2026 18:42:18 +0400 +Subject: [PATCH] Rewrite: fix buffer overflow with overlapping captures + +When the rewrite replacement string had no variables, but had +overlapping captures, the length of the allocated buffer could be +smaller than the replacement string. This could happen either +when the "redirect" parameter is specified, or when arguments are +present in the replacement string. + +The following configurations resulted in heap buffer overflow when +using URI "/++++++++++++++++++++++++++++++": + + location / { + rewrite ^/((.*))$ http://127.0.0.1:8080/$1$2 redirect; + return 200 foo; + } + + location / { + rewrite ^/((.*))$ http://127.0.0.1:8080/?$1$2; + return 200 foo; + } + +Reported by Mufeed VH of Winfunc Research. + +CVE: CVE-2026-9256 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/3f135ae2eb60ce376196c898a6c7cb4d774f7068] + +(cherry picked from commit 3f135ae2eb60ce376196c898a6c7cb4d774f7068) +Signed-off-by: Hetvi Thakar +--- + src/http/ngx_http_script.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c +index 2ea611373..8a28e23a6 100644 +--- a/src/http/ngx_http_script.c ++++ b/src/http/ngx_http_script.c +@@ -1037,6 +1037,8 @@ ngx_http_script_start_args_code(ngx_http_script_engine_t *e) + void + ngx_http_script_regex_start_code(ngx_http_script_engine_t *e) + { ++ int *cap; ++ u_char *p; + size_t len; + ngx_int_t rc; + ngx_uint_t n; +@@ -1143,15 +1145,19 @@ ngx_http_script_regex_start_code(ngx_http_script_engine_t *e) + if (code->lengths == NULL) { + e->buf.len = code->size; + +- if (code->uri) { +- if (r->ncaptures && (r->quoted_uri || r->plus_in_uri)) { +- e->buf.len += 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len, +- NGX_ESCAPE_ARGS); +- } +- } ++ cap = r->captures; ++ p = r->captures_data; + + for (n = 2; n < r->ncaptures; n += 2) { +- e->buf.len += r->captures[n + 1] - r->captures[n]; ++ e->buf.len += cap[n + 1] - cap[n]; ++ ++ if (code->uri) { ++ if (r->quoted_uri || r->plus_in_uri) { ++ e->buf.len += 2 * ngx_escape_uri(NULL, &p[cap[n]], ++ cap[n + 1] - cap[n], ++ NGX_ESCAPE_ARGS); ++ } ++ } + } + + } else { +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 308edd96bd..94ca40e36f 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -6,6 +6,7 @@ SRC_URI:append = " \ file://CVE-2026-42946_p1.patch \ file://CVE-2026-42946_p2.patch \ file://CVE-2026-42945.patch \ + file://CVE-2026-9256.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 4a3d524346..c5f8ea2645 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -6,6 +6,7 @@ SRC_URI:append = " \ file://CVE-2026-42946_p1.patch \ file://CVE-2026-42946_p2.patch \ file://CVE-2026-42945.patch \ + file://CVE-2026-9256.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100934 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76AA9CCA466 for ; Fri, 16 Oct 2026 03:21:02 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13829.1792120857841685084 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=ZofJTAEh; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=12118; q=dns/txt; s=iport01; t=1792120858; x=1793330458; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=nsaX5i6ugg8Qqni8zhnuDpMK0efWZ4icW8I1iYGWzY0=; b=ZofJTAEhoXuDVAvtdfzbakhM9La3OJ07wftow83UVmdt1mwyYfVG9yrW b7VoWMz0BX0bX6NEBdRXW2FuopAQL0j5XmBj/BW7+VsDRAdQF9YTGSvt8 ccoMNld1e/3j2xEF4mvsSy6o/kWaVF3DnSgomeic56584uMVkVslu9X1B k2GpLFsk1Rj2hle1crHA2eIBS/zrlZ05TugEjnWpqPfCeFfWEYVbBi60S JDWEoWFrNxfmEZuxdOTIcF1Btdfs2Me9lXjS10cVh5xuW1pA8ShJg8Ow2 BN+YFk6h8ZIEtppyhprs3E7xOE9P1qUXgwo0vSAI424Eg7GsZ26RTUcyQ w==; X-CSE-ConnectionGUID: cd1crOvDQdKFNxOUJXoyKg== X-CSE-MsgGUID: LrohbFJQQpKxhJGD4hraOw== X-IPAS-Result: A0CmAgBtltFq/5P/Ja1aglmCV3VgQ0kDjVeIBGwDnhyBfg8BAQEPRA0EAQGFBQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYARsSEBwDAQIvKyMIGYMCAYJ0AxEGvHOBeTOBAYJmQwGBVNsyAQsUAQWBM4VAiCNdGAGEfCcbG4FyhH6BBYFcAQEBgTeGbQSCIoEMgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5ITHoJkARYXEFEBKQEBgWuTUhQSkB2CIaEPCiiDdowilToaM6pvC5h9jgqWT4RpgWg8gVlwFYMiCUoZD44vCguDYIUTyUcnMgIJAy8BAQcCBw4DC4FokAGBfQEB IronPort-Data: A9a23:b0+SlK8WLpYoBC5h3YjmDrUD0X+TJUtcMsCJ2f8bNWPcYEJGY0x3z 2oYUD3SOqmJN2DzfYt0Pdvj808A7ZKHytNlQANu+39EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k9MdQT4MFpLVhC1 tI+OBcwTCCElsG5lefTpulE3qzPLeHxN48Z/3UlxjbDALN/GdbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0In1lQ/UPrSmM+omnn2cDRCgFmUvqEwpWPUyWSd1ZCwaoOEJIPXFZ09ckCwg njB/27XICgjLP+PyRiq3i6snObognauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8hkOgVtZ3L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzBCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1rN94cRva1fApEFI/ IronPort-HdrOrdr: A9a23:qRJLu6kRhyXw4eIjSE8x8EQVppzpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:n3akkG/UViW7HQJ4+Z2Vv0UYQ8s/VWPx9XvzDWmoLltLeLqEalDFrQ== X-Talos-MUID: 9a23:uvbF8QgEedMSX8fCxwtCScMpEN1v466AKnk0ibYWu+urGXBwIT66k2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="521967580" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 3B56118000273; Fri, 16 Oct 2026 03:20:57 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 880B5CBEF8A; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 06/11] nginx: fix CVE-2026-42055 Date: Thu, 15 Oct 2026 20:20:51 -0700 Message-Id: <20261016032056.409095-7-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131033 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Use version-specific backports: nginx 1.28.3 contains only the affected gRPC module, while nginx 1.29.7 also contains ngx_http_proxy_v2_module and therefore carries the complete upstream changes for both modules. [1] https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3 [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/nginx-1.28.3/CVE-2026-42055.patch | 108 ++++++++++ .../nginx/nginx-1.29.7/CVE-2026-42055.patch | 188 ++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 4 files changed, 298 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch new file mode 100644 index 0000000000..ce16a9279d --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch @@ -0,0 +1,108 @@ +From 131be8514da8985b15b74150521afedbf9cc4ea3 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Tue, 2 Jun 2026 19:37:17 +0400 +Subject: [PATCH] Upstream: limit header length for HTTP/2 and gRPC + +The change applies the HTTP/2 header length limits to avoid buffer +overflow. See 58a7bc3406ac for details. + +Reported by Mufeed VH of Winfunc Research. + +CVE: CVE-2026-42055 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3] + +Backport Changes: +- Dropped the ngx_http_proxy_v2_module.c hunk because that module is not + available in nginx 1.28.3. Retained the ngx_http_grpc_module.c fix. + +(cherry picked from commit 131be8514da8985b15b74150521afedbf9cc4ea3) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_grpc_module.c | 44 +++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c +index 80046d6a4..84ce51265 100644 +--- a/src/http/modules/ngx_http_grpc_module.c ++++ b/src/http/modules/ngx_http_grpc_module.c +@@ -749,6 +749,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + tmp_len = 0; + + } else { ++ if (r->method_name.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 method: \"%V\"", &r->method_name); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + r->method_name.len; + tmp_len = r->method_name.len; + } +@@ -769,6 +775,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + uri_len = r->uri.len + escape + sizeof("?") - 1 + r->args.len; + } + ++ if (uri_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 URI"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + uri_len; + + if (tmp_len < uri_len) { +@@ -778,6 +790,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + /* :authority header */ + + if (!glcf->host_set) { ++ if (ctx->host.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 host: \"%V\"", &ctx->host); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + ctx->host.len; + + if (tmp_len < ctx->host.len) { +@@ -808,6 +826,18 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (key_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name"); ++ return NGX_ERROR; ++ } ++ ++ if (val_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len + + NGX_HTTP_V2_INT_OCTETS + val_len; + +@@ -842,6 +872,20 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (header[i].key.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name: \"%V\"", ++ &header[i].key); ++ return NGX_ERROR; ++ } ++ ++ if (header[i].value.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value: \"%V: %V\"", ++ &header[i].key, &header[i].value); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + header[i].key.len + + NGX_HTTP_V2_INT_OCTETS + header[i].value.len; + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch new file mode 100644 index 0000000000..c10ab2dbc0 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch @@ -0,0 +1,188 @@ +From 131be8514da8985b15b74150521afedbf9cc4ea3 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Tue, 2 Jun 2026 19:37:17 +0400 +Subject: [PATCH] Upstream: limit header length for HTTP/2 and gRPC + +The change applies the HTTP/2 header length limits to avoid buffer +overflow. See 58a7bc3406ac for details. + +Reported by Mufeed VH of Winfunc Research. + +CVE: CVE-2026-42055 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3] + +(cherry picked from commit 131be8514da8985b15b74150521afedbf9cc4ea3) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_grpc_module.c | 44 +++++++++++++++++++++ + src/http/modules/ngx_http_proxy_v2_module.c | 44 +++++++++++++++++++++ + 2 files changed, 88 insertions(+) + +diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c +index cc3aebe59..1895ef31b 100644 +--- a/src/http/modules/ngx_http_grpc_module.c ++++ b/src/http/modules/ngx_http_grpc_module.c +@@ -749,6 +749,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + tmp_len = 0; + + } else { ++ if (r->method_name.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 method: \"%V\"", &r->method_name); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + r->method_name.len; + tmp_len = r->method_name.len; + } +@@ -769,6 +775,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + uri_len = r->uri.len + escape + sizeof("?") - 1 + r->args.len; + } + ++ if (uri_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 URI"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + uri_len; + + if (tmp_len < uri_len) { +@@ -778,6 +790,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + /* :authority header */ + + if (!glcf->host_set) { ++ if (ctx->host.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 host: \"%V\"", &ctx->host); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + ctx->host.len; + + if (tmp_len < ctx->host.len) { +@@ -808,6 +826,18 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (key_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name"); ++ return NGX_ERROR; ++ } ++ ++ if (val_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len + + NGX_HTTP_V2_INT_OCTETS + val_len; + +@@ -842,6 +872,20 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (header[i].key.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name: \"%V\"", ++ &header[i].key); ++ return NGX_ERROR; ++ } ++ ++ if (header[i].value.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value: \"%V: %V\"", ++ &header[i].key, &header[i].value); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + header[i].key.len + + NGX_HTTP_V2_INT_OCTETS + header[i].value.len; + +diff --git a/src/http/modules/ngx_http_proxy_v2_module.c b/src/http/modules/ngx_http_proxy_v2_module.c +index 4c282a864..637fa9a0e 100644 +--- a/src/http/modules/ngx_http_proxy_v2_module.c ++++ b/src/http/modules/ngx_http_proxy_v2_module.c +@@ -379,6 +379,12 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + tmp_len = 0; + + } else { ++ if (method.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 method: \"%V\"", &method); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + method.len; + tmp_len = method.len; + } +@@ -419,6 +425,12 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + return NGX_ERROR; + } + ++ if (uri_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 URI"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + uri_len; + + if (tmp_len < uri_len) { +@@ -430,6 +442,12 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + host = &ctx->ctx.vars.host_header; + + if (!plcf->host_set) { ++ if (host->len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 host: \"%V\"", host); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + host->len; + + if (tmp_len < host->len) { +@@ -486,6 +504,18 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + continue; + } + ++ if (key_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name"); ++ return NGX_ERROR; ++ } ++ ++ if (val_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len + + NGX_HTTP_V2_INT_OCTETS + val_len; + +@@ -520,6 +550,20 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + continue; + } + ++ if (header[i].key.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name: \"%V\"", ++ &header[i].key); ++ return NGX_ERROR; ++ } ++ ++ if (header[i].value.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value: \"%V: %V\"", ++ &header[i].key, &header[i].value); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + header[i].key.len + + NGX_HTTP_V2_INT_OCTETS + header[i].value.len; + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 94ca40e36f..a47e398422 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -7,6 +7,7 @@ SRC_URI:append = " \ file://CVE-2026-42946_p2.patch \ file://CVE-2026-42945.patch \ file://CVE-2026-9256.patch \ + file://CVE-2026-42055.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index c5f8ea2645..bfd82d5e31 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -7,6 +7,7 @@ SRC_URI:append = " \ file://CVE-2026-42946_p2.patch \ file://CVE-2026-42945.patch \ file://CVE-2026-9256.patch \ + file://CVE-2026-42055.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100938 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55541CCF2C0 for ; Fri, 16 Oct 2026 03:21:04 +0000 (UTC) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14026.1792120858133391716 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=EbhIcaXa; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3682; q=dns/txt; s=iport01; t=1792120858; x=1793330458; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=hzEJXWnNtlwLE+0POE3rjUSMhaqHItyLpCEVYRI2w+8=; b=EbhIcaXaykWqyuFjhph6BW+in5rxFcoH6KPNhW8nOp9pt5t17F0rTlXE KJypvwEBkeMrvBfkm3RlOc08VcNz9CxVcLFo9gYcSZtqFQqO8XPebXfHe dGkSIuq2s9bhd3Qgcm9jKzWf25/CcXVtDlvvN5Gp5QwtUpf/gQ9n3zNP0 +tT/Nle8Qq14jmbuSXz5yX6IwfZMi2TJfR/MVN8H+vgJjkHadGIrf3YaR UA0qVSpSSuRlbwzAgdFaOt7xG3B5cGwTJtfdzCXj+0WBh89XiJImr7sxo ta4EJFNtuujVM8vG2PAfUWZ8nR/ZeZumXoELCdhz5304KB6auhM0uNtJZ Q==; X-CSE-ConnectionGUID: 7dep1ew6RLSVULy73ueSVg== X-CSE-MsgGUID: IYR2nMqcQk+yx0SaLrvQEA== X-IPAS-Result: A0A/AwD1ltFq/5T/Ja1aglmCV3VgQ0kDjVeIBGwDnhyBfg8BAQEPRA0EAQGFBQKOFQImNQgOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYASAKAxAcAwECLysjCBmDAgGCdAMRBrx0gXkzgQGDKQGBVNsyAQsUAQWBM4VAiCNdGAGEfCcbG4FyhH6BBYFcAQEBiCQEgiKBDIFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSEx6CXgcWJzUcASkBAReBVJN4kj6hDwoog3aMIpU6GjOqbwuYfY4Klk+EaYFpATqBWXAVgyIJShkPji8KC4NghRPJRycyAgkDLwEBBwIHDgMLgWiEYY0dAQE IronPort-Data: A9a23:+Od2n6IRilBQnOd7FE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS0jAHy WEXXDiAM/eNambwetAlb4Ww9EID75HUm9JhQQAd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN0xAEwuZIAHpNxTOl9z0 e1Hcy0AVS6M0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVLAtQIvIROPB4towMDUY358VW62BI ZBENHw2MESojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsi+W3YIONI4biqcN9v3ei/ GTj5m/AAVILJISkwB6f7EuBr7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+rfSnh0qWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRul/fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:UBTJVq0a2DZ+gOvTEfLh/AqjBGokLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFebvN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn5E4sLxKDwMeOGAbqBJbK ah2g== X-Talos-CUID: 9a23:bQ7awGr70SuxEpld8wXb+C3mUZ8pf2WEwWiOGWuDN1tNWeLOVFKrxqwxxg== X-Talos-MUID: 9a23:GAvYWAkoCns/334l26ABdnpDBf0y5YG3A3kO0oQW4/KNETZuAhq02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535281012" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 3C1271800016D; Fri, 16 Oct 2026 03:20:57 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 8C10BCBEF98; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 07/11] nginx: fix CVE-2026-48142 Date: Thu, 15 Oct 2026 20:20:52 -0700 Message-Id: <20261016032056.409095-8-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131027 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/60c4243eb8775d51662a01def8a7dad5d9fb34a7 [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-48142.patch | 42 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 3 files changed, 44 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-48142.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-48142.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-48142.patch new file mode 100644 index 0000000000..1c39940fb7 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-48142.patch @@ -0,0 +1,42 @@ +From 60c4243eb8775d51662a01def8a7dad5d9fb34a7 Mon Sep 17 00:00:00 2001 +From: Sergey Kandaurov +Date: Mon, 1 Jun 2026 21:46:48 +0400 +Subject: [PATCH] Charset: fixed another rare buffer overread in + recode_from_utf8() + +With prerequisites similar to 696a7f1b9, it was possible to gain 1-byte +overread on invalid UTF-8 sequences. The reason is ngx_utf8_decode() +stops advancing the pointer position on the first encountered invalid +byte. The fix is to adjust the advanced pointer up to the whole saved +sequence in this case. Note that this may result in different output +compared to complete invalid UTF-8 sequences, which we can disregard +at this point. + +Reported by Han Yan of Xiaomi and p4p3r of CYBERONE. + +CVE: CVE-2026-48142 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/60c4243eb8775d51662a01def8a7dad5d9fb34a7] + +(cherry picked from commit 60c4243eb8775d51662a01def8a7dad5d9fb34a7) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_charset_filter_module.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c +index edb2db568..e0115e1e4 100644 +--- a/src/http/modules/ngx_http_charset_filter_module.c ++++ b/src/http/modules/ngx_http_charset_filter_module.c +@@ -855,6 +855,10 @@ ngx_http_charset_recode_from_utf8(ngx_pool_t *pool, ngx_buf_t *buf, + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, pool->log, 0, + "http charset invalid utf 1"); + ++ if (saved < &ctx->saved[ctx->saved_len]) { ++ saved = &ctx->saved[ctx->saved_len]; ++ } ++ + } else { + dst = ngx_sprintf(dst, "&#%uD;", n); + } +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index a47e398422..628e8f65b8 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -8,6 +8,7 @@ SRC_URI:append = " \ file://CVE-2026-42945.patch \ file://CVE-2026-9256.patch \ file://CVE-2026-42055.patch \ + file://CVE-2026-48142.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index bfd82d5e31..8ba04167c2 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -8,6 +8,7 @@ SRC_URI:append = " \ file://CVE-2026-42945.patch \ file://CVE-2026-9256.patch \ file://CVE-2026-42055.patch \ + file://CVE-2026-48142.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100939 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14B00CCA491 for ; Fri, 16 Oct 2026 03:21:04 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13832.1792120861021132594 for ; Thu, 15 Oct 2026 20:21:01 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=ejX7bJmE; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=86705; q=dns/txt; s=iport01; t=1792120861; x=1793330461; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=A9aKx75umZggPoP7ivm5xSR5PMLS/2fQbS8CxKVkNGw=; b=ejX7bJmEQuzSI00hX5yUs6nym0VNNDuHE1+400zlzi6DrKrylAAlAdnW l0XO9faRR7nCaDaC6nQcVMW3u3OAaKb82gQ8hgazqDP3lpyQTbMayiecX Nr8WYhU9sR6Yuy4hsJ2/oeLvbQ8eyFLNfKcXEmPA8RmeUN+8kEsXcouPd 3PkrUW6nDym6cmz9/PRWvwnOEG8aW/Ap6RiNPvIszxirwFget9s9aTU8m 4otRJXVc7NBFi9qdJJdPzLrYMKWqSUnhOp6MSf+quEV4vahsmwty0GAnE ObuR7B1Mv2m8ksH6P4KmTa2uoORGVg5nuOFSRjaedGmqg29ZI+g6/JvaG Q==; X-CSE-ConnectionGUID: 3qVXnAHrTxOkMWy0naeNyg== X-CSE-MsgGUID: DcvbFblkRsWpPLVOuvW+XA== X-IPAS-Result: A0CoAgCRl9Fq/5L/Ja1aglmCGD91YENJA41XiARsA5FKjFKBfg8BAQEPRA0EAQGFBQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMaAQwLARgBLRAcAwECLysjCBmCKlgBgnQDEQa8dIF5M4EBgykBgVTbMgELFAEFgTOFQIgjXRgBhHwnGxuBcoEVg2mBBYFcAQEBiCQEgiKBDIFaHjKUd0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5ITHoJkAQEsBAwbNgEpAQEigTUJC0+TAyYBB5AVgiGhDwoog3aMIpU6GjOqbwuYfY4KlTNMGTeEaYFoPIFDDwdwFYMiCUoZD44rAgEBCguDYIUTyUcnMgIJAy8BAQcCBw4DC4FohGGNHQEB IronPort-Data: A9a23:K+/DfKn+ehdGeiJGq77FTZPo5gzQJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIWWmiHaKuLYzagfN1yPI6y/U8H68PTn9cySQc4qCgyQltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsvzb8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FdYBxNZxKEFUy ew/KxUyf0iFju+Q0b3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMiSBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTZD/7C7pm9AusrnnjczRboUi9rqss6G+Vxwt0uFToGIePKoTTFZQIxy50o Erq9HrzLBseN+aE9iK91kyLm/Hw3hPSDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hguyVsxSL 2QQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cH3hKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Kxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:VIgifKyJYlNujRSaUX/vKrPw9L1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICPcqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIWpIObuEYdWIK7vrS0U2fD8sqxsWB/eSDgOfTyGoocCRRApsQljuQzm2gYzZLrM4sP+tAKK ah X-Talos-CUID: 9a23:oSIB1GvV4KB6K4KeCE0B8lIX6It+a0Ptyl7wOXOoLmVMd6zNT1ad3rJrxp8= X-Talos-MUID: 9a23:kBYYmAjMiyEojXInOyY8YcMpGMx26YqkDEM3iqoeg+26EjFuBHStpWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528018951" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 3D1DF18000202; Fri, 16 Oct 2026 03:20:57 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 90A49CBEFAB; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 08/11] nginx: fix CVE-2026-42533 Date: Thu, 15 Oct 2026 20:20:53 -0700 Message-Id: <20261016032056.409095-9-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131035 From: Hetvi Thakar These patches apply the upstream fix sequence as referenced in [6], using the commits shown in [1] through [5]. Use version-specific fourth patches: nginx 1.28.3 lacks ngx_http_proxy_v2_module, while the nginx 1.29.7 backport retains the applicable proxy-v2 bounds checks with its older request-body layout. [1] https://github.com/nginx/nginx/commit/ea47fabf55e2bc9192ddc27f52486b4e58d5e007 [2] https://github.com/nginx/nginx/commit/7ac67898bdfed2140a1bedcda252074cca11f494 [3] https://github.com/nginx/nginx/commit/78950bdcd443830bde00f6844dba3033c18862b1 [4] https://github.com/nginx/nginx/commit/326b17b0038321c29252e79bf4c53d4773fcb8b5 [5] https://github.com/nginx/nginx/commit/97e40e59b7b4ad6aa36f54ce4f1e64d1e98f24cb [6] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-42533_p1.patch | 127 +++ .../nginx/files/CVE-2026-42533_p2.patch | 381 +++++++++ .../nginx/files/CVE-2026-42533_p3.patch | 704 +++++++++++++++++ .../nginx/files/CVE-2026-42533_p5.patch | 254 ++++++ .../nginx-1.28.3/CVE-2026-42533_p4.patch | 587 ++++++++++++++ .../nginx-1.29.7/CVE-2026-42533_p4.patch | 723 ++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 5 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 5 + 8 files changed, 2786 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p1.patch create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p2.patch create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p3.patch create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p5.patch create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42533_p4.patch create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42533_p4.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p1.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p1.patch new file mode 100644 index 0000000000..bef2916e84 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p1.patch @@ -0,0 +1,127 @@ +From ea47fabf55e2bc9192ddc27f52486b4e58d5e007 Mon Sep 17 00:00:00 2001 +From: Maxim Dounin +Date: Fri, 19 Jun 2026 22:54:19 +0300 +Subject: [PATCH] Script: simplified copy capture codes. + +Signed-off-by: Roman Arutyunyan +Origin: + +CVE: CVE-2026-42533 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/ea47fabf55e2bc9192ddc27f52486b4e58d5e007] + +(cherry picked from commit ea47fabf55e2bc9192ddc27f52486b4e58d5e007) +Signed-off-by: Hetvi Thakar +--- + src/http/ngx_http_script.c | 22 ++++++++++++---------- + src/stream/ngx_stream_script.c | 10 +++++++--- + 2 files changed, 19 insertions(+), 13 deletions(-) + +diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c +index 8a28e23a6..6b33d01dd 100644 +--- a/src/http/ngx_http_script.c ++++ b/src/http/ngx_http_script.c +@@ -1343,6 +1343,7 @@ ngx_http_script_copy_capture_len_code(ngx_http_script_engine_t *e) + { + int *cap; + u_char *p; ++ size_t len; + ngx_uint_t n; + ngx_http_request_t *r; + ngx_http_script_copy_capture_code_t *code; +@@ -1358,17 +1359,17 @@ ngx_http_script_copy_capture_len_code(ngx_http_script_engine_t *e) + if (n < r->ncaptures) { + + cap = r->captures; ++ len = cap[n + 1] - cap[n]; + + if ((e->is_args || e->quote) + && (e->request->quoted_uri || e->request->plus_in_uri)) + { +- p = r->captures_data; ++ p = r->captures_data + cap[n]; ++ ++ return len + 2 * ngx_escape_uri(NULL, p, len, NGX_ESCAPE_ARGS); + +- return cap[n + 1] - cap[n] +- + 2 * ngx_escape_uri(NULL, &p[cap[n]], cap[n + 1] - cap[n], +- NGX_ESCAPE_ARGS); + } else { +- return cap[n + 1] - cap[n]; ++ return len; + } + } + +@@ -1381,6 +1382,7 @@ ngx_http_script_copy_capture_code(ngx_http_script_engine_t *e) + { + int *cap; + u_char *p, *pos; ++ size_t len; + ngx_uint_t n; + ngx_http_request_t *r; + ngx_http_script_copy_capture_code_t *code; +@@ -1398,16 +1400,16 @@ ngx_http_script_copy_capture_code(ngx_http_script_engine_t *e) + if (n < r->ncaptures) { + + cap = r->captures; +- p = r->captures_data; ++ len = cap[n + 1] - cap[n]; ++ p = r->captures_data + cap[n]; + + if ((e->is_args || e->quote) + && (e->request->quoted_uri || e->request->plus_in_uri)) + { +- e->pos = (u_char *) ngx_escape_uri(pos, &p[cap[n]], +- cap[n + 1] - cap[n], +- NGX_ESCAPE_ARGS); ++ e->pos = (u_char *) ngx_escape_uri(pos, p, len, NGX_ESCAPE_ARGS); ++ + } else { +- e->pos = ngx_copy(pos, &p[cap[n]], cap[n + 1] - cap[n]); ++ e->pos = ngx_copy(pos, p, len); + } + } + +diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c +index c447e152f..2cd8b08c7 100644 +--- a/src/stream/ngx_stream_script.c ++++ b/src/stream/ngx_stream_script.c +@@ -894,6 +894,7 @@ size_t + ngx_stream_script_copy_capture_len_code(ngx_stream_script_engine_t *e) + { + int *cap; ++ size_t len; + ngx_uint_t n; + ngx_stream_session_t *s; + ngx_stream_script_copy_capture_code_t *code; +@@ -908,7 +909,8 @@ ngx_stream_script_copy_capture_len_code(ngx_stream_script_engine_t *e) + + if (n < s->ncaptures) { + cap = s->captures; +- return cap[n + 1] - cap[n]; ++ len = cap[n + 1] - cap[n]; ++ return len; + } + + return 0; +@@ -920,6 +922,7 @@ ngx_stream_script_copy_capture_code(ngx_stream_script_engine_t *e) + { + int *cap; + u_char *p, *pos; ++ size_t len; + ngx_uint_t n; + ngx_stream_session_t *s; + ngx_stream_script_copy_capture_code_t *code; +@@ -936,8 +939,9 @@ ngx_stream_script_copy_capture_code(ngx_stream_script_engine_t *e) + + if (n < s->ncaptures) { + cap = s->captures; +- p = s->captures_data; +- e->pos = ngx_copy(pos, &p[cap[n]], cap[n + 1] - cap[n]); ++ len = cap[n + 1] - cap[n]; ++ p = s->captures_data + cap[n]; ++ e->pos = ngx_copy(pos, p, len); + } + + ngx_log_debug2(NGX_LOG_DEBUG_STREAM, e->session->connection->log, 0, +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p2.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p2.patch new file mode 100644 index 0000000000..c28eca55de --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p2.patch @@ -0,0 +1,381 @@ +From 7ac67898bdfed2140a1bedcda252074cca11f494 Mon Sep 17 00:00:00 2001 +From: Maxim Dounin +Date: Fri, 19 Jun 2026 22:54:27 +0300 +Subject: [PATCH] Script: buffer overrun protection. + +With this change, all script copy operations now check if there is +enough room in the buffer. To do so, the script engine now provides the +e->end pointer, which specifies expected buffer end, and each copy +operation is checked against it with the ngx_http_script_check_length() +function. + +The e->end pointer is optional and only checked when set, thus +introducing no incompatible API changes. All standard functions were +updated to use it, notably ngx_http_complex_value(), ngx_http_script_run(), +ngx_http_script_regex_start_code(), ngx_http_script_complex_value_code(). +Direct script evaluation in the proxy, fastcgi, scgi, uwsgi, grpc proxy, +index, and try_files modules will be updated by a separate patch. + +In particular, this catches issues as observed when evaluating variables +with side effects, such as in the following configuration: + + map $uri $map { + ~(?.*) $capture; + } + + set $capture ""; + set $temp "$capture $map"; + +As well as when evaluating non-cacheable variables, where length of a +variable might change between length and copy codes, such as in the +following configuration: + + map prefix:$capture $map_volatile { + volatile; + ~(?.*) $capture; + } + + set $capture ""; + set $temp "$map_volatile"; + +Similar changes were made in the stream module. + +Signed-off-by: Roman Arutyunyan +Origin: + +CVE: CVE-2026-42533 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/7ac67898bdfed2140a1bedcda252074cca11f494] + +(cherry picked from commit 7ac67898bdfed2140a1bedcda252074cca11f494) +Signed-off-by: Hetvi Thakar +--- + src/http/ngx_http_script.c | 63 ++++++++++++++++++++++++++++++++++ + src/http/ngx_http_script.h | 4 +++ + src/stream/ngx_stream_script.c | 45 ++++++++++++++++++++++++ + src/stream/ngx_stream_script.h | 5 +++ + 4 files changed, 117 insertions(+) + +diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c +index 6b33d01dd..d3af4408d 100644 +--- a/src/http/ngx_http_script.c ++++ b/src/http/ngx_http_script.c +@@ -92,12 +92,17 @@ ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val, + e.ip = val->values; + e.pos = value->data; + e.buf = *value; ++ e.end = value->data + len; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + *value = e.buf; + + return NGX_OK; +@@ -650,12 +655,17 @@ ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value, + + e.ip = code_values; + e.pos = value->data; ++ e.end = value->data + len; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NULL; ++ } ++ + return e.pos; + } + +@@ -805,6 +815,25 @@ ngx_http_script_add_code(ngx_array_t *codes, size_t size, void *code) + } + + ++ngx_int_t ++ngx_http_script_check_length(ngx_http_script_engine_t *e, size_t len) ++{ ++ if (e->end == NULL) { ++ return NGX_OK; ++ } ++ ++ if (e->end - e->pos < (ssize_t) len) { ++ ngx_log_error(NGX_LOG_ALERT, e->request->connection->log, 0, ++ "no buffer space in script copy"); ++ e->ip = ngx_http_script_exit; ++ e->status = NGX_HTTP_INTERNAL_SERVER_ERROR; ++ return NGX_ERROR; ++ } ++ ++ return NGX_OK; ++} ++ ++ + static ngx_int_t + ngx_http_script_add_copy_code(ngx_http_script_compile_t *sc, ngx_str_t *value, + ngx_uint_t last) +@@ -873,6 +902,11 @@ ngx_http_script_copy_code(ngx_http_script_engine_t *e) + p = e->pos; + + if (!e->skip) { ++ ++ if (ngx_http_script_check_length(e, code->len) != NGX_OK) { ++ return; ++ } ++ + e->pos = ngx_copy(p, e->ip + sizeof(ngx_http_script_copy_code_t), + code->len); + } +@@ -976,6 +1010,11 @@ ngx_http_script_copy_var_code(ngx_http_script_engine_t *e) + } + + if (value && !value->not_found) { ++ ++ if (ngx_http_script_check_length(e, value->len) != NGX_OK) { ++ return; ++ } ++ + p = e->pos; + e->pos = ngx_copy(p, value->data, value->len); + +@@ -1192,6 +1231,7 @@ ngx_http_script_regex_start_code(ngx_http_script_engine_t *e) + e->quote = code->redirect; + + e->pos = e->buf.data; ++ e->end = e->buf.data + e->buf.len; + + e->ip += sizeof(ngx_http_script_regex_code_t); + } +@@ -1229,6 +1269,11 @@ ngx_http_script_regex_end_code(ngx_http_script_engine_t *e) + e->pos = dst; + + if (code->add_args && r->args.len) { ++ ++ if (ngx_http_script_check_length(e, r->args.len + 1) != NGX_OK) { ++ return; ++ } ++ + *e->pos++ = (u_char) (code->args ? '&' : '?'); + e->pos = ngx_copy(e->pos, r->args.data, r->args.len); + } +@@ -1262,6 +1307,11 @@ ngx_http_script_regex_end_code(ngx_http_script_engine_t *e) + e->buf.len = e->args - e->buf.data; + + if (code->add_args && r->args.len) { ++ ++ if (ngx_http_script_check_length(e, r->args.len + 1) != NGX_OK) { ++ return; ++ } ++ + *e->pos++ = '&'; + e->pos = ngx_copy(e->pos, r->args.data, r->args.len); + } +@@ -1383,6 +1433,7 @@ ngx_http_script_copy_capture_code(ngx_http_script_engine_t *e) + int *cap; + u_char *p, *pos; + size_t len; ++ uintptr_t escape; + ngx_uint_t n; + ngx_http_request_t *r; + ngx_http_script_copy_capture_code_t *code; +@@ -1406,9 +1457,20 @@ ngx_http_script_copy_capture_code(ngx_http_script_engine_t *e) + if ((e->is_args || e->quote) + && (e->request->quoted_uri || e->request->plus_in_uri)) + { ++ escape = 2 * ngx_escape_uri(NULL, p, len, NGX_ESCAPE_ARGS); ++ ++ if (ngx_http_script_check_length(e, len + escape) != NGX_OK) { ++ return; ++ } ++ + e->pos = (u_char *) ngx_escape_uri(pos, p, len, NGX_ESCAPE_ARGS); + + } else { ++ ++ if (ngx_http_script_check_length(e, len) != NGX_OK) { ++ return; ++ } ++ + e->pos = ngx_copy(pos, p, len); + } + } +@@ -1792,6 +1854,7 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e) + } + + e->pos = e->buf.data; ++ e->end = e->buf.data + len; + + e->sp->len = e->buf.len; + e->sp->data = e->buf.data; +diff --git a/src/http/ngx_http_script.h b/src/http/ngx_http_script.h +index 43600383c..b086b266f 100644 +--- a/src/http/ngx_http_script.h ++++ b/src/http/ngx_http_script.h +@@ -17,6 +17,7 @@ + typedef struct { + u_char *ip; + u_char *pos; ++ u_char *end; + ngx_http_variable_value_t *sp; + + ngx_str_t buf; +@@ -240,6 +241,9 @@ void *ngx_http_script_start_code(ngx_pool_t *pool, ngx_array_t **codes, + size_t size); + void *ngx_http_script_add_code(ngx_array_t *codes, size_t size, void *code); + ++ngx_int_t ngx_http_script_check_length(ngx_http_script_engine_t *e, ++ size_t len); ++ + size_t ngx_http_script_copy_len_code(ngx_http_script_engine_t *e); + void ngx_http_script_copy_code(ngx_http_script_engine_t *e); + size_t ngx_http_script_copy_var_len_code(ngx_http_script_engine_t *e); +diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c +index 2cd8b08c7..2e31102df 100644 +--- a/src/stream/ngx_stream_script.c ++++ b/src/stream/ngx_stream_script.c +@@ -92,6 +92,7 @@ ngx_stream_complex_value(ngx_stream_session_t *s, + + e.ip = val->values; + e.pos = value->data; ++ e.end = value->data + len; + e.buf = *value; + + while (*(uintptr_t *) e.ip) { +@@ -99,6 +100,10 @@ ngx_stream_complex_value(ngx_stream_session_t *s, + code((ngx_stream_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + *value = e.buf; + + return NGX_OK; +@@ -526,12 +531,17 @@ ngx_stream_script_run(ngx_stream_session_t *s, ngx_str_t *value, + + e.ip = code_values; + e.pos = value->data; ++ e.end = value->data + len; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_stream_script_code_pt *) e.ip; + code((ngx_stream_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NULL; ++ } ++ + return e.pos; + } + +@@ -668,6 +678,25 @@ ngx_stream_script_add_code(ngx_array_t *codes, size_t size, void *code) + } + + ++ngx_int_t ++ngx_stream_script_check_length(ngx_stream_script_engine_t *e, size_t len) ++{ ++ if (e->end == NULL) { ++ return NGX_OK; ++ } ++ ++ if (e->end - e->pos < (ssize_t) len) { ++ ngx_log_error(NGX_LOG_ALERT, e->session->connection->log, 0, ++ "no buffer space in script copy"); ++ e->ip = ngx_stream_script_exit; ++ e->status = NGX_STREAM_INTERNAL_SERVER_ERROR; ++ return NGX_ERROR; ++ } ++ ++ return NGX_OK; ++} ++ ++ + static ngx_int_t + ngx_stream_script_add_copy_code(ngx_stream_script_compile_t *sc, + ngx_str_t *value, ngx_uint_t last) +@@ -737,6 +766,11 @@ ngx_stream_script_copy_code(ngx_stream_script_engine_t *e) + p = e->pos; + + if (!e->skip) { ++ ++ if (ngx_stream_script_check_length(e, code->len) != NGX_OK) { ++ return; ++ } ++ + e->pos = ngx_copy(p, e->ip + sizeof(ngx_stream_script_copy_code_t), + code->len); + } +@@ -841,6 +875,11 @@ ngx_stream_script_copy_var_code(ngx_stream_script_engine_t *e) + } + + if (value && !value->not_found) { ++ ++ if (ngx_stream_script_check_length(e, value->len) != NGX_OK) { ++ return; ++ } ++ + p = e->pos; + e->pos = ngx_copy(p, value->data, value->len); + +@@ -941,6 +980,11 @@ ngx_stream_script_copy_capture_code(ngx_stream_script_engine_t *e) + cap = s->captures; + len = cap[n + 1] - cap[n]; + p = s->captures_data + cap[n]; ++ ++ if (ngx_stream_script_check_length(e, len) != NGX_OK) { ++ return; ++ } ++ + e->pos = ngx_copy(pos, p, len); + } + +@@ -1013,6 +1057,7 @@ ngx_stream_script_full_name_code(ngx_stream_script_engine_t *e) + != NGX_OK) + { + e->ip = ngx_stream_script_exit; ++ e->status = NGX_STREAM_INTERNAL_SERVER_ERROR; + return; + } + +diff --git a/src/stream/ngx_stream_script.h b/src/stream/ngx_stream_script.h +index d8f374047..dc6de9c72 100644 +--- a/src/stream/ngx_stream_script.h ++++ b/src/stream/ngx_stream_script.h +@@ -17,6 +17,7 @@ + typedef struct { + u_char *ip; + u_char *pos; ++ u_char *end; + ngx_stream_variable_value_t *sp; + + ngx_str_t buf; +@@ -25,6 +26,7 @@ typedef struct { + unsigned flushed:1; + unsigned skip:1; + ++ ngx_int_t status; + ngx_stream_session_t *session; + } ngx_stream_script_engine_t; + +@@ -127,6 +129,9 @@ void ngx_stream_script_flush_no_cacheable_variables(ngx_stream_session_t *s, + + void *ngx_stream_script_add_code(ngx_array_t *codes, size_t size, void *code); + ++ngx_int_t ngx_stream_script_check_length(ngx_stream_script_engine_t *e, ++ size_t len); ++ + size_t ngx_stream_script_copy_len_code(ngx_stream_script_engine_t *e); + void ngx_stream_script_copy_code(ngx_stream_script_engine_t *e); + size_t ngx_stream_script_copy_var_len_code(ngx_stream_script_engine_t *e); +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p3.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p3.patch new file mode 100644 index 0000000000..2787cadb2d --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p3.patch @@ -0,0 +1,704 @@ +From 78950bdcd443830bde00f6844dba3033c18862b1 Mon Sep 17 00:00:00 2001 +From: Maxim Dounin +Date: Fri, 19 Jun 2026 22:55:38 +0300 +Subject: [PATCH] Access log: buffer overrun protection. + +Similarly to generic script operations, access log script copy operations +now check if there is enough room in the buffer. + +Signed-off-by: Roman Arutyunyan +Origin: + +CVE: CVE-2026-42533 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/78950bdcd443830bde00f6844dba3033c18862b1] + +(cherry picked from commit 78950bdcd443830bde00f6844dba3033c18862b1) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_log_module.c | 185 ++++++++++++++++++++----- + src/stream/ngx_stream_log_module.c | 101 +++++++++++--- + 2 files changed, 235 insertions(+), 51 deletions(-) + +diff --git a/src/http/modules/ngx_http_log_module.c b/src/http/modules/ngx_http_log_module.c +index f7c4bd2f5..d282362ea 100644 +--- a/src/http/modules/ngx_http_log_module.c ++++ b/src/http/modules/ngx_http_log_module.c +@@ -17,7 +17,7 @@ + typedef struct ngx_http_log_op_s ngx_http_log_op_t; + + typedef u_char *(*ngx_http_log_op_run_pt) (ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + + typedef size_t (*ngx_http_log_op_getlen_pt) (ngx_http_request_t *r, + uintptr_t data); +@@ -112,39 +112,42 @@ static void ngx_http_log_flush(ngx_open_file_t *file, ngx_log_t *log); + static void ngx_http_log_flush_handler(ngx_event_t *ev); + + static u_char *ngx_http_log_pipe(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static u_char *ngx_http_log_time(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static u_char *ngx_http_log_iso8601(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static u_char *ngx_http_log_msec(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static u_char *ngx_http_log_request_time(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static u_char *ngx_http_log_status(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static u_char *ngx_http_log_bytes_sent(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); +-static u_char *ngx_http_log_body_bytes_sent(ngx_http_request_t *r, +- u_char *buf, ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); ++static u_char *ngx_http_log_body_bytes_sent(ngx_http_request_t *r, u_char *buf, ++ u_char *end, ngx_http_log_op_t *op); + static u_char *ngx_http_log_request_length(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + + static ngx_int_t ngx_http_log_variable_compile(ngx_conf_t *cf, + ngx_http_log_op_t *op, ngx_str_t *value, ngx_uint_t escape); + static size_t ngx_http_log_variable_getlen(ngx_http_request_t *r, + uintptr_t data); + static u_char *ngx_http_log_variable(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static uintptr_t ngx_http_log_escape(u_char *dst, u_char *src, size_t size); + static size_t ngx_http_log_json_variable_getlen(ngx_http_request_t *r, + uintptr_t data); + static u_char *ngx_http_log_json_variable(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op); ++ u_char *end, ngx_http_log_op_t *op); + static size_t ngx_http_log_unescaped_variable_getlen(ngx_http_request_t *r, + uintptr_t data); + static u_char *ngx_http_log_unescaped_variable(ngx_http_request_t *r, +- u_char *buf, ngx_http_log_op_t *op); ++ u_char *buf, u_char *end, ngx_http_log_op_t *op); ++ ++static ngx_int_t ngx_http_log_check_length(ngx_http_request_t *r, ++ u_char *buf, u_char *end, size_t len); + + + static void *ngx_http_log_create_main_conf(ngx_conf_t *cf); +@@ -253,7 +256,7 @@ static ngx_http_log_var_t ngx_http_log_vars[] = { + static ngx_int_t + ngx_http_log_handler(ngx_http_request_t *r) + { +- u_char *line, *p; ++ u_char *line, *p, *end; + size_t len, size; + ssize_t n; + ngx_str_t val; +@@ -309,6 +312,8 @@ ngx_http_log_handler(ngx_http_request_t *r) + } + } + ++ len += NGX_LINEFEED_SIZE; ++ + if (log[l].syslog_peer) { + + /* length of syslog's PRI and HEADER message parts */ +@@ -319,8 +324,6 @@ ngx_http_log_handler(ngx_http_request_t *r) + goto alloc_line; + } + +- len += NGX_LINEFEED_SIZE; +- + buffer = log[l].file ? log[l].file->data : NULL; + + if (buffer) { +@@ -336,13 +339,18 @@ ngx_http_log_handler(ngx_http_request_t *r) + if (len <= (size_t) (buffer->last - buffer->pos)) { + + p = buffer->pos; ++ end = p + len - NGX_LINEFEED_SIZE; + + if (buffer->event && p == buffer->start) { + ngx_add_timer(buffer->event, buffer->flush); + } + +- for (i = 0; i < log[l].format->ops->nelts; i++) { +- p = op[i].run(r, p, &op[i]); ++ for (i = 0; i < log[l].format->ops->nelts && p; i++) { ++ p = op[i].run(r, p, end, &op[i]); ++ } ++ ++ if (p == NULL) { ++ return NGX_ERROR; + } + + ngx_linefeed(p); +@@ -365,13 +373,18 @@ ngx_http_log_handler(ngx_http_request_t *r) + } + + p = line; ++ end = line + len - NGX_LINEFEED_SIZE; + + if (log[l].syslog_peer) { + p = ngx_syslog_add_header(log[l].syslog_peer, line); + } + +- for (i = 0; i < log[l].format->ops->nelts; i++) { +- p = op[i].run(r, p, &op[i]); ++ for (i = 0; i < log[l].format->ops->nelts && p; i++) { ++ p = op[i].run(r, p, end, &op[i]); ++ } ++ ++ if (p == NULL) { ++ return NGX_ERROR; + } + + if (log[l].syslog_peer) { +@@ -770,7 +783,7 @@ ngx_http_log_flush_handler(ngx_event_t *ev) + + + static u_char * +-ngx_http_log_copy_short(ngx_http_request_t *r, u_char *buf, ++ngx_http_log_copy_short(ngx_http_request_t *r, u_char *buf, u_char *end, + ngx_http_log_op_t *op) + { + size_t len; +@@ -779,6 +792,10 @@ ngx_http_log_copy_short(ngx_http_request_t *r, u_char *buf, + len = op->len; + data = op->data; + ++ if (ngx_http_log_check_length(r, buf, end, len) != NGX_OK) { ++ return NULL; ++ } ++ + while (len--) { + *buf++ = (u_char) (data & 0xff); + data >>= 8; +@@ -789,16 +806,25 @@ ngx_http_log_copy_short(ngx_http_request_t *r, u_char *buf, + + + static u_char * +-ngx_http_log_copy_long(ngx_http_request_t *r, u_char *buf, ++ngx_http_log_copy_long(ngx_http_request_t *r, u_char *buf, u_char *end, + ngx_http_log_op_t *op) + { ++ if (ngx_http_log_check_length(r, buf, end, op->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, (u_char *) op->data, op->len); + } + + + static u_char * +-ngx_http_log_pipe(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) ++ngx_http_log_pipe(ngx_http_request_t *r, u_char *buf, u_char *end, ++ ngx_http_log_op_t *op) + { ++ if (ngx_http_log_check_length(r, buf, end, 1) != NGX_OK) { ++ return NULL; ++ } ++ + if (r->pipeline) { + *buf = 'p'; + } else { +@@ -810,24 +836,43 @@ ngx_http_log_pipe(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) + + + static u_char * +-ngx_http_log_time(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) ++ngx_http_log_time(ngx_http_request_t *r, u_char *buf, u_char *end, ++ ngx_http_log_op_t *op) + { ++ if (ngx_http_log_check_length(r, buf, end, ngx_cached_http_log_time.len) ++ != NGX_OK) ++ { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, ngx_cached_http_log_time.data, + ngx_cached_http_log_time.len); + } + + static u_char * +-ngx_http_log_iso8601(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) ++ngx_http_log_iso8601(ngx_http_request_t *r, u_char *buf, u_char *end, ++ ngx_http_log_op_t *op) + { ++ if (ngx_http_log_check_length(r, buf, end, ngx_cached_http_log_iso8601.len) ++ != NGX_OK) ++ { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, ngx_cached_http_log_iso8601.data, + ngx_cached_http_log_iso8601.len); + } + + static u_char * +-ngx_http_log_msec(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) ++ngx_http_log_msec(ngx_http_request_t *r, u_char *buf, u_char *end, ++ ngx_http_log_op_t *op) + { + ngx_time_t *tp; + ++ if (ngx_http_log_check_length(r, buf, end, NGX_TIME_T_LEN + 4) != NGX_OK) { ++ return NULL; ++ } ++ + tp = ngx_timeofday(); + + return ngx_sprintf(buf, "%T.%03M", tp->sec, tp->msec); +@@ -835,12 +880,16 @@ ngx_http_log_msec(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) + + + static u_char * +-ngx_http_log_request_time(ngx_http_request_t *r, u_char *buf, ++ngx_http_log_request_time(ngx_http_request_t *r, u_char *buf, u_char *end, + ngx_http_log_op_t *op) + { + ngx_time_t *tp; + ngx_msec_int_t ms; + ++ if (ngx_http_log_check_length(r, buf, end, NGX_TIME_T_LEN + 4) != NGX_OK) { ++ return NULL; ++ } ++ + tp = ngx_timeofday(); + + ms = (ngx_msec_int_t) +@@ -852,10 +901,15 @@ ngx_http_log_request_time(ngx_http_request_t *r, u_char *buf, + + + static u_char * +-ngx_http_log_status(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) ++ngx_http_log_status(ngx_http_request_t *r, u_char *buf, u_char *end, ++ ngx_http_log_op_t *op) + { + ngx_uint_t status; + ++ if (ngx_http_log_check_length(r, buf, end, NGX_INT_T_LEN) != NGX_OK) { ++ return NULL; ++ } ++ + if (r->err_status) { + status = r->err_status; + +@@ -874,9 +928,13 @@ ngx_http_log_status(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) + + + static u_char * +-ngx_http_log_bytes_sent(ngx_http_request_t *r, u_char *buf, ++ngx_http_log_bytes_sent(ngx_http_request_t *r, u_char *buf, u_char *end, + ngx_http_log_op_t *op) + { ++ if (ngx_http_log_check_length(r, buf, end, NGX_OFF_T_LEN) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_sprintf(buf, "%O", r->connection->sent); + } + +@@ -887,11 +945,15 @@ ngx_http_log_bytes_sent(ngx_http_request_t *r, u_char *buf, + */ + + static u_char * +-ngx_http_log_body_bytes_sent(ngx_http_request_t *r, u_char *buf, ++ngx_http_log_body_bytes_sent(ngx_http_request_t *r, u_char *buf, u_char *end, + ngx_http_log_op_t *op) + { + off_t length; + ++ if (ngx_http_log_check_length(r, buf, end, NGX_OFF_T_LEN) != NGX_OK) { ++ return NULL; ++ } ++ + length = r->connection->sent - r->header_size; + + if (length > 0) { +@@ -905,9 +967,13 @@ ngx_http_log_body_bytes_sent(ngx_http_request_t *r, u_char *buf, + + + static u_char * +-ngx_http_log_request_length(ngx_http_request_t *r, u_char *buf, ++ngx_http_log_request_length(ngx_http_request_t *r, u_char *buf, u_char *end, + ngx_http_log_op_t *op) + { ++ if (ngx_http_log_check_length(r, buf, end, NGX_OFF_T_LEN) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_sprintf(buf, "%O", r->request_length); + } + +@@ -968,21 +1034,39 @@ ngx_http_log_variable_getlen(ngx_http_request_t *r, uintptr_t data) + + + static u_char * +-ngx_http_log_variable(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op) ++ngx_http_log_variable(ngx_http_request_t *r, u_char *buf, u_char *end, ++ ngx_http_log_op_t *op) + { ++ uintptr_t len; + ngx_http_variable_value_t *value; + + value = ngx_http_get_indexed_variable(r, op->data); + + if (value == NULL || value->not_found) { ++ if (ngx_http_log_check_length(r, buf, end, 1) != NGX_OK) { ++ return NULL; ++ } ++ + *buf = '-'; + return buf + 1; + } + + if (value->escape == 0) { ++ if (ngx_http_log_check_length(r, buf, end, value->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, value->data, value->len); + + } else { ++ len = ngx_http_log_escape(NULL, value->data, value->len); ++ ++ if (ngx_http_log_check_length(r, buf, end, value->len + len * 3) ++ != NGX_OK) ++ { ++ return NULL; ++ } ++ + return (u_char *) ngx_http_log_escape(buf, value->data, value->len); + } + } +@@ -1069,9 +1153,10 @@ ngx_http_log_json_variable_getlen(ngx_http_request_t *r, uintptr_t data) + + + static u_char * +-ngx_http_log_json_variable(ngx_http_request_t *r, u_char *buf, ++ngx_http_log_json_variable(ngx_http_request_t *r, u_char *buf, u_char *end, + ngx_http_log_op_t *op) + { ++ uintptr_t len; + ngx_http_variable_value_t *value; + + value = ngx_http_get_indexed_variable(r, op->data); +@@ -1081,9 +1166,21 @@ ngx_http_log_json_variable(ngx_http_request_t *r, u_char *buf, + } + + if (value->escape == 0) { ++ if (ngx_http_log_check_length(r, buf, end, value->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, value->data, value->len); + + } else { ++ len = ngx_escape_json(NULL, value->data, value->len); ++ ++ if (ngx_http_log_check_length(r, buf, end, value->len + len) ++ != NGX_OK) ++ { ++ return NULL; ++ } ++ + return (u_char *) ngx_escape_json(buf, value->data, value->len); + } + } +@@ -1108,7 +1205,7 @@ ngx_http_log_unescaped_variable_getlen(ngx_http_request_t *r, uintptr_t data) + + static u_char * + ngx_http_log_unescaped_variable(ngx_http_request_t *r, u_char *buf, +- ngx_http_log_op_t *op) ++ u_char *end, ngx_http_log_op_t *op) + { + ngx_http_variable_value_t *value; + +@@ -1118,10 +1215,28 @@ ngx_http_log_unescaped_variable(ngx_http_request_t *r, u_char *buf, + return buf; + } + ++ if (ngx_http_log_check_length(r, buf, end, value->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, value->data, value->len); + } + + ++static ngx_int_t ++ngx_http_log_check_length(ngx_http_request_t *r, u_char *buf, u_char *end, ++ size_t len) ++{ ++ if (end - buf < (ssize_t) len) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in log script copy"); ++ return NGX_ERROR; ++ } ++ ++ return NGX_OK; ++} ++ ++ + static void * + ngx_http_log_create_main_conf(ngx_conf_t *cf) + { +diff --git a/src/stream/ngx_stream_log_module.c b/src/stream/ngx_stream_log_module.c +index 0ff7f4244..774bc7e93 100644 +--- a/src/stream/ngx_stream_log_module.c ++++ b/src/stream/ngx_stream_log_module.c +@@ -17,7 +17,7 @@ + typedef struct ngx_stream_log_op_s ngx_stream_log_op_t; + + typedef u_char *(*ngx_stream_log_op_run_pt) (ngx_stream_session_t *s, +- u_char *buf, ngx_stream_log_op_t *op); ++ u_char *buf, u_char *end, ngx_stream_log_op_t *op); + + typedef size_t (*ngx_stream_log_op_getlen_pt) (ngx_stream_session_t *s, + uintptr_t data); +@@ -115,16 +115,19 @@ static ngx_int_t ngx_stream_log_variable_compile(ngx_conf_t *cf, + static size_t ngx_stream_log_variable_getlen(ngx_stream_session_t *s, + uintptr_t data); + static u_char *ngx_stream_log_variable(ngx_stream_session_t *s, u_char *buf, +- ngx_stream_log_op_t *op); ++ u_char *end, ngx_stream_log_op_t *op); + static uintptr_t ngx_stream_log_escape(u_char *dst, u_char *src, size_t size); + static size_t ngx_stream_log_json_variable_getlen(ngx_stream_session_t *s, + uintptr_t data); + static u_char *ngx_stream_log_json_variable(ngx_stream_session_t *s, +- u_char *buf, ngx_stream_log_op_t *op); ++ u_char *buf, u_char *end, ngx_stream_log_op_t *op); + static size_t ngx_stream_log_unescaped_variable_getlen(ngx_stream_session_t *s, + uintptr_t data); + static u_char *ngx_stream_log_unescaped_variable(ngx_stream_session_t *s, +- u_char *buf, ngx_stream_log_op_t *op); ++ u_char *buf, u_char *end, ngx_stream_log_op_t *op); ++ ++static ngx_int_t ngx_stream_log_check_length(ngx_stream_session_t *s, ++ u_char *buf, u_char *end, size_t len); + + + static void *ngx_stream_log_create_main_conf(ngx_conf_t *cf); +@@ -200,7 +203,7 @@ ngx_module_t ngx_stream_log_module = { + static ngx_int_t + ngx_stream_log_handler(ngx_stream_session_t *s) + { +- u_char *line, *p; ++ u_char *line, *p, *end; + size_t len, size; + ssize_t n; + ngx_str_t val; +@@ -257,6 +260,8 @@ ngx_stream_log_handler(ngx_stream_session_t *s) + } + } + ++ len += NGX_LINEFEED_SIZE; ++ + if (log[l].syslog_peer) { + + /* length of syslog's PRI and HEADER message parts */ +@@ -267,8 +272,6 @@ ngx_stream_log_handler(ngx_stream_session_t *s) + goto alloc_line; + } + +- len += NGX_LINEFEED_SIZE; +- + buffer = log[l].file ? log[l].file->data : NULL; + + if (buffer) { +@@ -284,13 +287,18 @@ ngx_stream_log_handler(ngx_stream_session_t *s) + if (len <= (size_t) (buffer->last - buffer->pos)) { + + p = buffer->pos; ++ end = p + len - NGX_LINEFEED_SIZE; + + if (buffer->event && p == buffer->start) { + ngx_add_timer(buffer->event, buffer->flush); + } + +- for (i = 0; i < log[l].format->ops->nelts; i++) { +- p = op[i].run(s, p, &op[i]); ++ for (i = 0; i < log[l].format->ops->nelts && p; i++) { ++ p = op[i].run(s, p, end, &op[i]); ++ } ++ ++ if (p == NULL) { ++ return NGX_ERROR; + } + + ngx_linefeed(p); +@@ -313,13 +321,18 @@ ngx_stream_log_handler(ngx_stream_session_t *s) + } + + p = line; ++ end = p + len - NGX_LINEFEED_SIZE; + + if (log[l].syslog_peer) { + p = ngx_syslog_add_header(log[l].syslog_peer, line); + } + +- for (i = 0; i < log[l].format->ops->nelts; i++) { +- p = op[i].run(s, p, &op[i]); ++ for (i = 0; i < log[l].format->ops->nelts && p; i++) { ++ p = op[i].run(s, p, end, &op[i]); ++ } ++ ++ if (p == NULL) { ++ return NGX_ERROR; + } + + if (log[l].syslog_peer) { +@@ -663,7 +676,7 @@ ngx_stream_log_flush_handler(ngx_event_t *ev) + + + static u_char * +-ngx_stream_log_copy_short(ngx_stream_session_t *s, u_char *buf, ++ngx_stream_log_copy_short(ngx_stream_session_t *s, u_char *buf, u_char *end, + ngx_stream_log_op_t *op) + { + size_t len; +@@ -672,6 +685,10 @@ ngx_stream_log_copy_short(ngx_stream_session_t *s, u_char *buf, + len = op->len; + data = op->data; + ++ if (ngx_stream_log_check_length(s, buf, end, len) != NGX_OK) { ++ return NULL; ++ } ++ + while (len--) { + *buf++ = (u_char) (data & 0xff); + data >>= 8; +@@ -682,9 +699,13 @@ ngx_stream_log_copy_short(ngx_stream_session_t *s, u_char *buf, + + + static u_char * +-ngx_stream_log_copy_long(ngx_stream_session_t *s, u_char *buf, ++ngx_stream_log_copy_long(ngx_stream_session_t *s, u_char *buf, u_char *end, + ngx_stream_log_op_t *op) + { ++ if (ngx_stream_log_check_length(s, buf, end, op->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, (u_char *) op->data, op->len); + } + +@@ -745,22 +766,39 @@ ngx_stream_log_variable_getlen(ngx_stream_session_t *s, uintptr_t data) + + + static u_char * +-ngx_stream_log_variable(ngx_stream_session_t *s, u_char *buf, ++ngx_stream_log_variable(ngx_stream_session_t *s, u_char *buf, u_char *end, + ngx_stream_log_op_t *op) + { ++ uintptr_t len; + ngx_stream_variable_value_t *value; + + value = ngx_stream_get_indexed_variable(s, op->data); + + if (value == NULL || value->not_found) { ++ if (ngx_stream_log_check_length(s, buf, end, 1) != NGX_OK) { ++ return NULL; ++ } ++ + *buf = '-'; + return buf + 1; + } + + if (value->escape == 0) { ++ if (ngx_stream_log_check_length(s, buf, end, value->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, value->data, value->len); + + } else { ++ len = ngx_stream_log_escape(NULL, value->data, value->len); ++ ++ if (ngx_stream_log_check_length(s, buf, end, value->len + len * 3) ++ != NGX_OK) ++ { ++ return NULL; ++ } ++ + return (u_char *) ngx_stream_log_escape(buf, value->data, value->len); + } + } +@@ -847,9 +885,10 @@ ngx_stream_log_json_variable_getlen(ngx_stream_session_t *s, uintptr_t data) + + + static u_char * +-ngx_stream_log_json_variable(ngx_stream_session_t *s, u_char *buf, ++ngx_stream_log_json_variable(ngx_stream_session_t *s, u_char *buf, u_char *end, + ngx_stream_log_op_t *op) + { ++ uintptr_t len; + ngx_stream_variable_value_t *value; + + value = ngx_stream_get_indexed_variable(s, op->data); +@@ -859,9 +898,21 @@ ngx_stream_log_json_variable(ngx_stream_session_t *s, u_char *buf, + } + + if (value->escape == 0) { ++ if (ngx_stream_log_check_length(s, buf, end, value->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, value->data, value->len); + + } else { ++ len = ngx_escape_json(NULL, value->data, value->len); ++ ++ if (ngx_stream_log_check_length(s, buf, end, value->len + len) ++ != NGX_OK) ++ { ++ return NULL; ++ } ++ + return (u_char *) ngx_escape_json(buf, value->data, value->len); + } + } +@@ -887,7 +938,7 @@ ngx_stream_log_unescaped_variable_getlen(ngx_stream_session_t *s, + + static u_char * + ngx_stream_log_unescaped_variable(ngx_stream_session_t *s, u_char *buf, +- ngx_stream_log_op_t *op) ++ u_char *end, ngx_stream_log_op_t *op) + { + ngx_stream_variable_value_t *value; + +@@ -897,10 +948,28 @@ ngx_stream_log_unescaped_variable(ngx_stream_session_t *s, u_char *buf, + return buf; + } + ++ if (ngx_stream_log_check_length(s, buf, end, value->len) != NGX_OK) { ++ return NULL; ++ } ++ + return ngx_cpymem(buf, value->data, value->len); + } + + ++static ngx_int_t ++ngx_stream_log_check_length(ngx_stream_session_t *s, u_char *buf, u_char *end, ++ size_t len) ++{ ++ if (end - buf < (ssize_t) len) { ++ ngx_log_error(NGX_LOG_ALERT, s->connection->log, 0, ++ "no buffer space in log script copy"); ++ return NGX_ERROR; ++ } ++ ++ return NGX_OK; ++} ++ ++ + static void * + ngx_stream_log_create_main_conf(ngx_conf_t *cf) + { +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p5.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p5.patch new file mode 100644 index 0000000000..d9d4f730cd --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533_p5.patch @@ -0,0 +1,254 @@ +From 97e40e59b7b4ad6aa36f54ce4f1e64d1e98f24cb Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Fri, 3 Jul 2026 15:11:09 +0400 +Subject: [PATCH] Script: avoid garbage at the end of the result string + +If the script result turned out to be shorter than its predicted +length, the result string contained uninitialized bytes at the end. +The fix is to cut the result string by its actual size. + +The following locations returned trailing garbage to the client with +URI "/1234abcd". + + map $uri $foo { + ~^/(?[0-9]).*$ $bar; + } + + location ~(?[0-9]*)[a-z]*$ { + return 200 $1:$foo; + } + + location ~(?[0-9]*)[a-z]*$ { + set $qux $1:$foo; + return 200 $qux; + } + +CVE: CVE-2026-42533 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/97e40e59b7b4ad6aa36f54ce4f1e64d1e98f24cb] + +(cherry picked from commit 97e40e59b7b4ad6aa36f54ce4f1e64d1e98f24cb) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_rewrite_module.c | 18 ++++++++++--- + src/http/ngx_http_script.c | 30 +++++++++++++++++----- + src/http/ngx_http_script.h | 6 +++++ + src/stream/ngx_stream_script.c | 18 +++++++++---- + 4 files changed, 57 insertions(+), 15 deletions(-) + +diff --git a/src/http/modules/ngx_http_rewrite_module.c b/src/http/modules/ngx_http_rewrite_module.c +index ff3b68716..eefe4c8c8 100644 +--- a/src/http/modules/ngx_http_rewrite_module.c ++++ b/src/http/modules/ngx_http_rewrite_module.c +@@ -966,10 +966,11 @@ static char * + ngx_http_rewrite_value(ngx_conf_t *cf, ngx_http_rewrite_loc_conf_t *lcf, + ngx_str_t *value) + { +- ngx_int_t n; +- ngx_http_script_compile_t sc; +- ngx_http_script_value_code_t *val; +- ngx_http_script_complex_value_code_t *complex; ++ ngx_int_t n; ++ ngx_http_script_compile_t sc; ++ ngx_http_script_value_code_t *val; ++ ngx_http_script_complex_value_code_t *complex; ++ ngx_http_script_complex_value_end_code_t *complex_end; + + n = ngx_http_script_variables_count(value); + +@@ -1016,5 +1017,14 @@ ngx_http_rewrite_value(ngx_conf_t *cf, ngx_http_rewrite_loc_conf_t *lcf, + return NGX_CONF_ERROR; + } + ++ complex_end = ngx_http_script_add_code(lcf->codes, ++ sizeof(ngx_http_script_complex_value_end_code_t), ++ &complex); ++ if (complex_end == NULL) { ++ return NGX_CONF_ERROR; ++ } ++ ++ complex_end->code = ngx_http_script_complex_value_end_code; ++ + return NGX_CONF_OK; + } +diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c +index d3af4408d..9c97a5b08 100644 +--- a/src/http/ngx_http_script.c ++++ b/src/http/ngx_http_script.c +@@ -103,7 +103,8 @@ ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val, + return NGX_ERROR; + } + +- *value = e.buf; ++ value->data = e.buf.data; ++ value->len = e.pos - e.buf.data; + + return NGX_OK; + } +@@ -620,6 +621,7 @@ u_char * + ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value, + void *code_lengths, size_t len, void *code_values) + { ++ size_t n; + ngx_uint_t i; + ngx_http_script_code_pt code; + ngx_http_script_len_code_pt lcode; +@@ -641,21 +643,23 @@ ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value, + e.request = r; + e.flushed = 1; + ++ n = len; ++ + while (*(uintptr_t *) e.ip) { + lcode = *(ngx_http_script_len_code_pt *) e.ip; +- len += lcode(&e); ++ n += lcode(&e); + } + + +- value->len = len; +- value->data = ngx_pnalloc(r->pool, len); ++ value->len = n; ++ value->data = ngx_pnalloc(r->pool, n); + if (value->data == NULL) { + return NULL; + } + + e.ip = code_values; + e.pos = value->data; +- e.end = value->data + len; ++ e.end = value->data + n; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; +@@ -666,6 +670,8 @@ ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value, + return NULL; + } + ++ value->len = e.pos + len - value->data; ++ + return e.pos; + } + +@@ -1548,6 +1554,8 @@ ngx_http_script_full_name_code(ngx_http_script_engine_t *e) + } + + e->buf = value; ++ e->pos = value.data + value.len; ++ e->end = e->pos; + + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0, + "http script fullname: \"%V\"", &value); +@@ -1855,8 +1863,18 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e) + + e->pos = e->buf.data; + e->end = e->buf.data + len; ++} ++ ++ ++void ++ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e) ++{ ++ e->ip += sizeof(ngx_http_script_complex_value_end_code_t); ++ ++ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0, ++ "http script complex value end"); + +- e->sp->len = e->buf.len; ++ e->sp->len = e->pos - e->buf.data; + e->sp->data = e->buf.data; + e->sp++; + } +diff --git a/src/http/ngx_http_script.h b/src/http/ngx_http_script.h +index b086b266f..4f2fbd16e 100644 +--- a/src/http/ngx_http_script.h ++++ b/src/http/ngx_http_script.h +@@ -200,6 +200,11 @@ typedef struct { + } ngx_http_script_complex_value_code_t; + + ++typedef struct { ++ ngx_http_script_code_pt code; ++} ngx_http_script_complex_value_end_code_t; ++ ++ + typedef struct { + ngx_http_script_code_pt code; + uintptr_t value; +@@ -263,6 +268,7 @@ void ngx_http_script_equal_code(ngx_http_script_engine_t *e); + void ngx_http_script_not_equal_code(ngx_http_script_engine_t *e); + void ngx_http_script_file_code(ngx_http_script_engine_t *e); + void ngx_http_script_complex_value_code(ngx_http_script_engine_t *e); ++void ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e); + void ngx_http_script_value_code(ngx_http_script_engine_t *e); + void ngx_http_script_set_var_code(ngx_http_script_engine_t *e); + void ngx_http_script_var_set_handler_code(ngx_http_script_engine_t *e); +diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c +index 2e31102df..559b8b9fb 100644 +--- a/src/stream/ngx_stream_script.c ++++ b/src/stream/ngx_stream_script.c +@@ -104,7 +104,8 @@ ngx_stream_complex_value(ngx_stream_session_t *s, + return NGX_ERROR; + } + +- *value = e.buf; ++ value->data = e.buf.data; ++ value->len = e.pos - e.buf.data; + + return NGX_OK; + } +@@ -496,6 +497,7 @@ u_char * + ngx_stream_script_run(ngx_stream_session_t *s, ngx_str_t *value, + void *code_lengths, size_t len, void *code_values) + { ++ size_t n; + ngx_uint_t i; + ngx_stream_script_code_pt code; + ngx_stream_script_engine_t e; +@@ -517,21 +519,23 @@ ngx_stream_script_run(ngx_stream_session_t *s, ngx_str_t *value, + e.session = s; + e.flushed = 1; + ++ n = len; ++ + while (*(uintptr_t *) e.ip) { + lcode = *(ngx_stream_script_len_code_pt *) e.ip; +- len += lcode(&e); ++ n += lcode(&e); + } + + +- value->len = len; +- value->data = ngx_pnalloc(s->connection->pool, len); ++ value->len = n; ++ value->data = ngx_pnalloc(s->connection->pool, n); + if (value->data == NULL) { + return NULL; + } + + e.ip = code_values; + e.pos = value->data; +- e.end = value->data + len; ++ e.end = value->data + n; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_stream_script_code_pt *) e.ip; +@@ -542,6 +546,8 @@ ngx_stream_script_run(ngx_stream_session_t *s, ngx_str_t *value, + return NULL; + } + ++ value->len = e.pos + len - value->data; ++ + return e.pos; + } + +@@ -1062,6 +1068,8 @@ ngx_stream_script_full_name_code(ngx_stream_script_engine_t *e) + } + + e->buf = value; ++ e->pos = value.data + value.len; ++ e->end = e->pos; + + ngx_log_debug1(NGX_LOG_DEBUG_STREAM, e->session->connection->log, 0, + "stream script fullname: \"%V\"", &value); +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42533_p4.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42533_p4.patch new file mode 100644 index 0000000000..599970bafa --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42533_p4.patch @@ -0,0 +1,587 @@ +From 326b17b0038321c29252e79bf4c53d4773fcb8b5 Mon Sep 17 00:00:00 2001 +From: Maxim Dounin +Date: Fri, 19 Jun 2026 22:54:46 +0300 +Subject: [PATCH] Script: buffer overrun protection in direct script usage. + +Following the previous change, this change adds script overrun +protection to direct script evaluation in the proxy, fastcgi, scgi, +uwsgi, grpc proxy, index, and try_files modules. + +This change is a modified version of a patch by Maxim Dounin. The +modifications include ngx_http_proxy_v2_module and hardened size checks. + +Signed-off-by: Roman Arutyunyan +Origin: + +CVE: CVE-2026-42533 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/326b17b0038321c29252e79bf4c53d4773fcb8b5] + +Backport Changes: +- Dropped the ngx_http_proxy_v2_module.c hunk because that module is not + available in nginx 1.28.3. + +(cherry picked from commit 326b17b0038321c29252e79bf4c53d4773fcb8b5) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_fastcgi_module.c | 26 ++++++++-- + src/http/modules/ngx_http_grpc_module.c | 52 ++++++++++++++++++-- + src/http/modules/ngx_http_index_module.c | 13 ++++- + src/http/modules/ngx_http_proxy_module.c | 31 ++++++++++-- + src/http/modules/ngx_http_scgi_module.c | 27 +++++++++- + src/http/modules/ngx_http_try_files_module.c | 17 ++++++- + src/http/modules/ngx_http_uwsgi_module.c | 30 ++++++++++- + 7 files changed, 180 insertions(+), 16 deletions(-) + +diff --git a/src/http/modules/ngx_http_fastcgi_module.c b/src/http/modules/ngx_http_fastcgi_module.c +index 6b1977340..ea8542caf 100644 +--- a/src/http/modules/ngx_http_fastcgi_module.c ++++ b/src/http/modules/ngx_http_fastcgi_module.c +@@ -836,8 +836,8 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + { + off_t file_pos; + u_char ch, sep, *pos, *lowcase_key; +- size_t size, len, key_len, val_len, padding, +- allocated; ++ size_t size, len, params_len, ++ key_len, val_len, padding, allocated; + ngx_uint_t i, n, next, hash, skip_empty, header_params; + ngx_buf_t *b; + ngx_chain_t *cl, *body; +@@ -852,6 +852,7 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + ngx_http_script_len_code_pt lcode; + + len = 0; ++ params_len = 0; + header_params = 0; + ignored = NULL; + +@@ -891,8 +892,10 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + continue; + } + +- len += 1 + key_len + ((val_len > 127) ? 4 : 1) + val_len; ++ params_len += 1 + key_len + ((val_len > 127) ? 4 : 1) + val_len; + } ++ ++ len += params_len; + } + + if (flcf->upstream.pass_request_headers) { +@@ -1048,6 +1051,7 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + + e.ip = params->values->elts; + e.pos = b->last; ++ e.end = b->last + params_len; + e.request = r; + e.flushed = 1; + +@@ -1080,6 +1084,12 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + continue; + } + ++ if (ngx_http_script_check_length(&e, 1 + ((val_len > 127) ? 4 : 1)) ++ != NGX_OK) ++ { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = (u_char) key_len; + + if (val_len > 127) { +@@ -1098,12 +1108,22 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + } + e.ip += sizeof(uintptr_t); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "fastcgi param: \"%*s: %*s\"", + key_len, e.pos - (key_len + val_len), + val_len, e.pos - val_len); + } + ++ if (e.pos != e.end) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "fastcgi request length mismatch"); ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c +index 84ce51265..fba2a517b 100644 +--- a/src/http/modules/ngx_http_grpc_module.c ++++ b/src/http/modules/ngx_http_grpc_module.c +@@ -717,8 +717,10 @@ ngx_http_grpc_eval(ngx_http_request_t *r, ngx_http_grpc_ctx_t *ctx, + static ngx_int_t + ngx_http_grpc_create_request(ngx_http_request_t *r) + { +- u_char *p, *tmp, *key_tmp, *val_tmp, *headers_frame; +- size_t len, tmp_len, key_len, val_len, uri_len; ++ u_char *p, *tmp, *key_tmp, *val_tmp, *headers_frame, ++ *headers_end; ++ size_t len, headers_len, tmp_len, ++ key_len, val_len, uri_len; + uintptr_t escape; + ngx_buf_t *b; + ngx_uint_t i, next; +@@ -742,6 +744,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + len = sizeof(ngx_http_grpc_connection_start) - 1 + + sizeof(ngx_http_grpc_frame_t); /* headers frame */ + ++ headers_len = 0; ++ + /* :method header */ + + if (r->method == NGX_HTTP_GET || r->method == NGX_HTTP_POST) { +@@ -838,8 +842,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + return NGX_ERROR; + } + +- len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len +- + NGX_HTTP_V2_INT_OCTETS + val_len; ++ headers_len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len ++ + NGX_HTTP_V2_INT_OCTETS + val_len; + + if (tmp_len < key_len) { + tmp_len = key_len; +@@ -850,6 +854,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + } + } + ++ len += headers_len; ++ + if (glcf->upstream.pass_request_headers) { + part = &r->headers_in.headers.part; + header = part->elts; +@@ -1046,6 +1052,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + + le.ip = glcf->headers.lengths->elts; + ++ headers_end = b->last + headers_len; ++ + while (*(uintptr_t *) le.ip) { + + lcode = *(ngx_http_script_len_code_pt *) le.ip; +@@ -1070,16 +1078,38 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (headers_end - b->last < 1) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in grpc create request"); ++ return NGX_ERROR; ++ } ++ + *b->last++ = 0; + + e.pos = key_tmp; ++ e.end = key_tmp + tmp_len; + + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ key_len = e.pos - key_tmp; ++ ++ if (headers_end - b->last ++ < (ssize_t) (NGX_HTTP_V2_INT_OCTETS + key_len)) ++ { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in grpc create request"); ++ return NGX_ERROR; ++ } ++ + b->last = ngx_http_v2_write_name(b->last, key_tmp, key_len, tmp); + + e.pos = val_tmp; ++ e.end = val_tmp + tmp_len; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; +@@ -1087,6 +1117,20 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + } + e.ip += sizeof(uintptr_t); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ val_len = e.pos - val_tmp; ++ ++ if (headers_end - b->last ++ < (ssize_t) (NGX_HTTP_V2_INT_OCTETS + val_len)) ++ { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in grpc create request"); ++ return NGX_ERROR; ++ } ++ + b->last = ngx_http_v2_write_value(b->last, val_tmp, val_len, tmp); + + #if (NGX_DEBUG) +diff --git a/src/http/modules/ngx_http_index_module.c b/src/http/modules/ngx_http_index_module.c +index 18e7049c5..149b44725 100644 +--- a/src/http/modules/ngx_http_index_module.c ++++ b/src/http/modules/ngx_http_index_module.c +@@ -126,6 +126,7 @@ ngx_http_index_handler(ngx_http_request_t *r) + name = NULL; + /* suppress MSVC warning */ + path.data = NULL; ++ e.status = 0; + + index = ilcf->indices->elts; + for (i = 0; i < ilcf->indices->nelts; i++) { +@@ -180,18 +181,28 @@ ngx_http_index_handler(ngx_http_request_t *r) + } else { + e.ip = index[i].values->elts; + e.pos = name; ++ e.end = name + allocated; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_HTTP_INTERNAL_SERVER_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 1) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + if (*name == '/') { +- uri.len = len - 1; ++ uri.len = e.pos - name; + uri.data = name; + return ngx_http_internal_redirect(r, &uri, &r->args); + } + ++ len = e.pos - name + 1; + path.len = e.pos - path.data; + + *e.pos = '\0'; +diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c +index 454ef6270..b336b8be7 100644 +--- a/src/http/modules/ngx_http_proxy_module.c ++++ b/src/http/modules/ngx_http_proxy_module.c +@@ -1256,7 +1256,7 @@ ngx_http_proxy_create_key(ngx_http_request_t *r) + static ngx_int_t + ngx_http_proxy_create_request(ngx_http_request_t *r) + { +- size_t len, uri_len, loc_len, body_len, ++ size_t len, uri_len, loc_len, body_len, headers_len, + key_len, val_len; + uintptr_t escape; + ngx_buf_t *b; +@@ -1310,6 +1310,8 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + escape = 0; + loc_len = 0; + unparsed_uri = 0; ++ body_len = 0; ++ headers_len = 0; + + if (plcf->proxy_lengths && ctx->vars.uri.len) { + uri_len = ctx->vars.uri.len; +@@ -1348,7 +1350,6 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + le.ip = plcf->body_lengths->elts; + le.request = r; + le.flushed = 1; +- body_len = 0; + + while (*(uintptr_t *) le.ip) { + lcode = *(ngx_http_script_len_code_pt *) le.ip; +@@ -1384,9 +1385,11 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + continue; + } + +- len += key_len + sizeof(": ") - 1 + val_len + sizeof(CRLF) - 1; ++ headers_len += key_len + sizeof(": ") - 1 + val_len + sizeof(CRLF) - 1; + } + ++ len += headers_len; ++ + + if (plcf->upstream.pass_request_headers) { + part = &r->headers_in.headers.part; +@@ -1478,6 +1481,7 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + + e.ip = headers->values->elts; + e.pos = b->last; ++ e.end = b->last + headers_len; + e.request = r; + e.flushed = 1; + +@@ -1510,6 +1514,14 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = ':'; *e.pos++ = ' '; + + while (*(uintptr_t *) e.ip) { +@@ -1518,6 +1530,14 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + } + e.ip += sizeof(uintptr_t); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = CR; *e.pos++ = LF; + } + +@@ -1568,6 +1588,7 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + if (plcf->body_values) { + e.ip = plcf->body_values->elts; + e.pos = b->last; ++ e.end = b->last + body_len; + e.skip = 0; + + while (*(uintptr_t *) e.ip) { +@@ -1575,6 +1596,10 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c +index 7477df317..1f0ebb468 100644 +--- a/src/http/modules/ngx_http_scgi_module.c ++++ b/src/http/modules/ngx_http_scgi_module.c +@@ -634,7 +634,7 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + { + off_t content_length_n; + u_char ch, sep, *key, *val, *lowcase_key; +- size_t len, key_len, val_len, allocated; ++ size_t len, params_len, key_len, val_len, allocated; + ngx_buf_t *b; + ngx_str_t content_length; + ngx_uint_t i, n, hash, skip_empty, header_params; +@@ -661,6 +661,7 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + + len = sizeof("CONTENT_LENGTH") + content_length.len + 1; + ++ params_len = 0; + header_params = 0; + ignored = NULL; + +@@ -698,8 +699,10 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + continue; + } + +- len += key_len + val_len + 1; ++ params_len += key_len + val_len + 1; + } ++ ++ len += params_len; + } + + if (scf->upstream.pass_request_headers) { +@@ -814,6 +817,7 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + + e.ip = params->values->elts; + e.pos = b->last; ++ e.end = b->last + params_len; + e.request = r; + e.flushed = 1; + +@@ -852,6 +856,10 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + #if (NGX_DEBUG) + val = e.pos; + #endif +@@ -859,6 +867,15 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + } ++ ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 1) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = '\0'; + e.ip += sizeof(uintptr_t); + +@@ -866,6 +883,12 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + "scgi param: \"%s: %s\"", key, val); + } + ++ if (e.pos != e.end) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "scgi request length mismatch"); ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +diff --git a/src/http/modules/ngx_http_try_files_module.c b/src/http/modules/ngx_http_try_files_module.c +index ce783a24d..bbdab8598 100644 +--- a/src/http/modules/ngx_http_try_files_module.c ++++ b/src/http/modules/ngx_http_try_files_module.c +@@ -78,7 +78,7 @@ ngx_module_t ngx_http_try_files_module = { + static ngx_int_t + ngx_http_try_files_handler(ngx_http_request_t *r) + { +- size_t len, root, alias, reserve, allocated; ++ size_t len, root, alias, reserve, allocated, n; + u_char *p, *name; + ngx_str_t path, args; + ngx_uint_t test_dir; +@@ -162,8 +162,15 @@ ngx_http_try_files_handler(ngx_http_request_t *r) + path.len = (name + tf->name.len - 1) - path.data; + + } else { ++ n = allocated; ++ ++ if (alias != NGX_MAX_SIZE_T_VALUE) { ++ n += (r->uri.len - alias); ++ } ++ + e.ip = tf->values->elts; + e.pos = name; ++ e.end = name + n; + e.flushed = 1; + + while (*(uintptr_t *) e.ip) { +@@ -171,6 +178,14 @@ ngx_http_try_files_handler(ngx_http_request_t *r) + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_HTTP_INTERNAL_SERVER_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 1) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + path.len = e.pos - path.data; + + *e.pos = '\0'; +diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c +index d012f4fd4..3b83fb2af 100644 +--- a/src/http/modules/ngx_http_uwsgi_module.c ++++ b/src/http/modules/ngx_http_uwsgi_module.c +@@ -857,7 +857,7 @@ static ngx_int_t + ngx_http_uwsgi_create_request(ngx_http_request_t *r) + { + u_char ch, sep, *lowcase_key; +- size_t key_len, val_len, len, allocated; ++ size_t key_len, val_len, len, params_len, allocated; + ngx_uint_t i, n, hash, skip_empty, header_params; + ngx_buf_t *b; + ngx_chain_t *cl, *body; +@@ -870,6 +870,7 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + ngx_http_script_len_code_pt lcode; + + len = 0; ++ params_len = 0; + header_params = 0; + ignored = NULL; + +@@ -907,8 +908,10 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + continue; + } + +- len += 2 + key_len + 2 + val_len; ++ params_len += 2 + key_len + 2 + val_len; + } ++ ++ len += params_len; + } + + if (uwcf->upstream.pass_request_headers) { +@@ -1040,6 +1043,7 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + + e.ip = params->values->elts; + e.pos = b->last; ++ e.end = b->last + params_len; + e.request = r; + e.flushed = 1; + +@@ -1072,12 +1076,24 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + continue; + } + ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = (u_char) (key_len & 0xff); + *e.pos++ = (u_char) ((key_len >> 8) & 0xff); + + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = (u_char) (val_len & 0xff); + *e.pos++ = (u_char) ((val_len >> 8) & 0xff); + +@@ -1086,6 +1102,10 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + e.ip += sizeof(uintptr_t); + + ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, +@@ -1094,6 +1114,12 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + val_len, e.pos - val_len); + } + ++ if (e.pos != e.end) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "uwsgi request length mismatch"); ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42533_p4.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42533_p4.patch new file mode 100644 index 0000000000..4f94d11674 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42533_p4.patch @@ -0,0 +1,723 @@ +From 326b17b0038321c29252e79bf4c53d4773fcb8b5 Mon Sep 17 00:00:00 2001 +From: Maxim Dounin +Date: Fri, 19 Jun 2026 22:54:46 +0300 +Subject: [PATCH] Script: buffer overrun protection in direct script usage. + +Following the previous change, this change adds script overrun +protection to direct script evaluation in the proxy, fastcgi, scgi, +uwsgi, grpc proxy, index, and try_files modules. + +This change is a modified version of a patch by Maxim Dounin. The +modifications include ngx_http_proxy_v2_module and hardened size checks. + +Signed-off-by: Roman Arutyunyan +Origin: + +CVE: CVE-2026-42533 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/326b17b0038321c29252e79bf4c53d4773fcb8b5] + +Backport Changes: +- Applied the proxy-v2 request-body buffer-end and script-status checks to + nginx 1.29.7's existing initial-buffer path; later nginx versions perform + the same body rendering in a separate chain buffer. + +(cherry picked from commit 326b17b0038321c29252e79bf4c53d4773fcb8b5) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_fastcgi_module.c | 26 +++++++-- + src/http/modules/ngx_http_grpc_module.c | 52 ++++++++++++++++-- + src/http/modules/ngx_http_index_module.c | 13 ++++- + src/http/modules/ngx_http_proxy_module.c | 31 +++++++++-- + src/http/modules/ngx_http_proxy_v2_module.c | 57 ++++++++++++++++++-- + src/http/modules/ngx_http_scgi_module.c | 27 +++++++++- + src/http/modules/ngx_http_try_files_module.c | 17 +++++- + src/http/modules/ngx_http_uwsgi_module.c | 30 ++++++++++- + 8 files changed, 233 insertions(+), 20 deletions(-) + +diff --git a/src/http/modules/ngx_http_fastcgi_module.c b/src/http/modules/ngx_http_fastcgi_module.c +index f7f0696a8..21c106778 100644 +--- a/src/http/modules/ngx_http_fastcgi_module.c ++++ b/src/http/modules/ngx_http_fastcgi_module.c +@@ -845,8 +845,8 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + { + off_t file_pos; + u_char ch, sep, *pos, *lowcase_key; +- size_t size, len, key_len, val_len, padding, +- allocated; ++ size_t size, len, params_len, ++ key_len, val_len, padding, allocated; + ngx_uint_t i, n, next, hash, skip_empty, header_params; + ngx_buf_t *b; + ngx_chain_t *cl, *body; +@@ -861,6 +861,7 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + ngx_http_script_len_code_pt lcode; + + len = 0; ++ params_len = 0; + header_params = 0; + ignored = NULL; + +@@ -900,8 +901,10 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + continue; + } + +- len += 1 + key_len + ((val_len > 127) ? 4 : 1) + val_len; ++ params_len += 1 + key_len + ((val_len > 127) ? 4 : 1) + val_len; + } ++ ++ len += params_len; + } + + if (flcf->upstream.pass_request_headers) { +@@ -1057,6 +1060,7 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + + e.ip = params->values->elts; + e.pos = b->last; ++ e.end = b->last + params_len; + e.request = r; + e.flushed = 1; + +@@ -1089,6 +1093,12 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + continue; + } + ++ if (ngx_http_script_check_length(&e, 1 + ((val_len > 127) ? 4 : 1)) ++ != NGX_OK) ++ { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = (u_char) key_len; + + if (val_len > 127) { +@@ -1107,12 +1117,22 @@ ngx_http_fastcgi_create_request(ngx_http_request_t *r) + } + e.ip += sizeof(uintptr_t); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "fastcgi param: \"%*s: %*s\"", + key_len, e.pos - (key_len + val_len), + val_len, e.pos - val_len); + } + ++ if (e.pos != e.end) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "fastcgi request length mismatch"); ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c +index 1895ef31b..681828109 100644 +--- a/src/http/modules/ngx_http_grpc_module.c ++++ b/src/http/modules/ngx_http_grpc_module.c +@@ -717,8 +717,10 @@ ngx_http_grpc_eval(ngx_http_request_t *r, ngx_http_grpc_ctx_t *ctx, + static ngx_int_t + ngx_http_grpc_create_request(ngx_http_request_t *r) + { +- u_char *p, *tmp, *key_tmp, *val_tmp, *headers_frame; +- size_t len, tmp_len, key_len, val_len, uri_len; ++ u_char *p, *tmp, *key_tmp, *val_tmp, *headers_frame, ++ *headers_end; ++ size_t len, headers_len, tmp_len, ++ key_len, val_len, uri_len; + uintptr_t escape; + ngx_buf_t *b; + ngx_uint_t i, next; +@@ -742,6 +744,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + len = sizeof(ngx_http_grpc_connection_start) - 1 + + sizeof(ngx_http_grpc_frame_t); /* headers frame */ + ++ headers_len = 0; ++ + /* :method header */ + + if (r->method == NGX_HTTP_GET || r->method == NGX_HTTP_POST) { +@@ -838,8 +842,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + return NGX_ERROR; + } + +- len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len +- + NGX_HTTP_V2_INT_OCTETS + val_len; ++ headers_len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len ++ + NGX_HTTP_V2_INT_OCTETS + val_len; + + if (tmp_len < key_len) { + tmp_len = key_len; +@@ -850,6 +854,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + } + } + ++ len += headers_len; ++ + if (glcf->upstream.pass_request_headers) { + part = &r->headers_in.headers.part; + header = part->elts; +@@ -1046,6 +1052,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + + le.ip = glcf->headers.lengths->elts; + ++ headers_end = b->last + headers_len; ++ + while (*(uintptr_t *) le.ip) { + + lcode = *(ngx_http_script_len_code_pt *) le.ip; +@@ -1070,16 +1078,38 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (headers_end - b->last < 1) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in grpc create request"); ++ return NGX_ERROR; ++ } ++ + *b->last++ = 0; + + e.pos = key_tmp; ++ e.end = key_tmp + tmp_len; + + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ key_len = e.pos - key_tmp; ++ ++ if (headers_end - b->last ++ < (ssize_t) (NGX_HTTP_V2_INT_OCTETS + key_len)) ++ { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in grpc create request"); ++ return NGX_ERROR; ++ } ++ + b->last = ngx_http_v2_write_name(b->last, key_tmp, key_len, tmp); + + e.pos = val_tmp; ++ e.end = val_tmp + tmp_len; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; +@@ -1087,6 +1117,20 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + } + e.ip += sizeof(uintptr_t); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ val_len = e.pos - val_tmp; ++ ++ if (headers_end - b->last ++ < (ssize_t) (NGX_HTTP_V2_INT_OCTETS + val_len)) ++ { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in grpc create request"); ++ return NGX_ERROR; ++ } ++ + b->last = ngx_http_v2_write_value(b->last, val_tmp, val_len, tmp); + + #if (NGX_DEBUG) +diff --git a/src/http/modules/ngx_http_index_module.c b/src/http/modules/ngx_http_index_module.c +index 18e7049c5..149b44725 100644 +--- a/src/http/modules/ngx_http_index_module.c ++++ b/src/http/modules/ngx_http_index_module.c +@@ -126,6 +126,7 @@ ngx_http_index_handler(ngx_http_request_t *r) + name = NULL; + /* suppress MSVC warning */ + path.data = NULL; ++ e.status = 0; + + index = ilcf->indices->elts; + for (i = 0; i < ilcf->indices->nelts; i++) { +@@ -180,18 +181,28 @@ ngx_http_index_handler(ngx_http_request_t *r) + } else { + e.ip = index[i].values->elts; + e.pos = name; ++ e.end = name + allocated; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_HTTP_INTERNAL_SERVER_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 1) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + if (*name == '/') { +- uri.len = len - 1; ++ uri.len = e.pos - name; + uri.data = name; + return ngx_http_internal_redirect(r, &uri, &r->args); + } + ++ len = e.pos - name + 1; + path.len = e.pos - path.data; + + *e.pos = '\0'; +diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c +index 276cc0750..f3263cd5f 100644 +--- a/src/http/modules/ngx_http_proxy_module.c ++++ b/src/http/modules/ngx_http_proxy_module.c +@@ -1173,7 +1173,7 @@ ngx_http_proxy_create_key(ngx_http_request_t *r) + static ngx_int_t + ngx_http_proxy_create_request(ngx_http_request_t *r) + { +- size_t len, uri_len, loc_len, body_len, ++ size_t len, uri_len, loc_len, body_len, headers_len, + key_len, val_len; + uintptr_t escape; + ngx_buf_t *b; +@@ -1227,6 +1227,8 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + escape = 0; + loc_len = 0; + unparsed_uri = 0; ++ body_len = 0; ++ headers_len = 0; + + if (plcf->proxy_lengths && ctx->vars.uri.len) { + uri_len = ctx->vars.uri.len; +@@ -1265,7 +1267,6 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + le.ip = plcf->body_lengths->elts; + le.request = r; + le.flushed = 1; +- body_len = 0; + + while (*(uintptr_t *) le.ip) { + lcode = *(ngx_http_script_len_code_pt *) le.ip; +@@ -1301,9 +1302,11 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + continue; + } + +- len += key_len + sizeof(": ") - 1 + val_len + sizeof(CRLF) - 1; ++ headers_len += key_len + sizeof(": ") - 1 + val_len + sizeof(CRLF) - 1; + } + ++ len += headers_len; ++ + + if (plcf->upstream.pass_request_headers) { + part = &r->headers_in.headers.part; +@@ -1395,6 +1398,7 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + + e.ip = headers->values->elts; + e.pos = b->last; ++ e.end = b->last + headers_len; + e.request = r; + e.flushed = 1; + +@@ -1427,6 +1431,14 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = ':'; *e.pos++ = ' '; + + while (*(uintptr_t *) e.ip) { +@@ -1435,6 +1447,14 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + } + e.ip += sizeof(uintptr_t); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = CR; *e.pos++ = LF; + } + +@@ -1485,6 +1505,7 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + if (plcf->body_values) { + e.ip = plcf->body_values->elts; + e.pos = b->last; ++ e.end = b->last + body_len; + e.skip = 0; + + while (*(uintptr_t *) e.ip) { +@@ -1492,6 +1513,10 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +diff --git a/src/http/modules/ngx_http_proxy_v2_module.c b/src/http/modules/ngx_http_proxy_v2_module.c +index 637fa9a0e..1952e48d1 100644 +--- a/src/http/modules/ngx_http_proxy_v2_module.c ++++ b/src/http/modules/ngx_http_proxy_v2_module.c +@@ -317,8 +317,10 @@ ngx_http_proxy_v2_handler(ngx_http_request_t *r) + static ngx_int_t + ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + { +- u_char *p, *tmp, *key_tmp, *val_tmp, *headers_frame; +- size_t len, tmp_len, key_len, val_len, uri_len, ++ u_char *p, *tmp, *key_tmp, *val_tmp, *headers_frame, ++ *headers_end; ++ size_t len, headers_len, tmp_len, ++ key_len, val_len, uri_len, + loc_len, body_len; + uintptr_t escape; + ngx_buf_t *b; +@@ -370,6 +372,8 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + len = sizeof(ngx_http_proxy_v2_connection_start) - 1 + + sizeof(ngx_http_proxy_v2_frame_t); /* headers frame */ + ++ headers_len = 0; ++ + /* :method header */ + + if ((method.len == 3 && ngx_strncmp(method.data, "GET", 3) == 0) +@@ -516,8 +520,8 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + return NGX_ERROR; + } + +- len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len +- + NGX_HTTP_V2_INT_OCTETS + val_len; ++ headers_len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len ++ + NGX_HTTP_V2_INT_OCTETS + val_len; + + if (tmp_len < key_len) { + tmp_len = key_len; +@@ -528,6 +532,8 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + } + } + ++ len += headers_len; ++ + if (plcf->upstream.pass_request_headers) { + part = &r->headers_in.headers.part; + header = part->elts; +@@ -730,6 +736,8 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + + le.ip = headers->lengths->elts; + ++ headers_end = b->last + headers_len; ++ + while (*(uintptr_t *) le.ip) { + + lcode = *(ngx_http_script_len_code_pt *) le.ip; +@@ -754,16 +762,38 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + continue; + } + ++ if (headers_end - b->last < 1) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in HTTP/2 create request"); ++ return NGX_ERROR; ++ } ++ + *b->last++ = 0; + + e.pos = key_tmp; ++ e.end = key_tmp + tmp_len; + + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ key_len = e.pos - key_tmp; ++ ++ if (headers_end - b->last ++ < (ssize_t) (NGX_HTTP_V2_INT_OCTETS + key_len)) ++ { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in HTTP/2 create request"); ++ return NGX_ERROR; ++ } ++ + b->last = ngx_http_v2_write_name(b->last, key_tmp, key_len, tmp); + + e.pos = val_tmp; ++ e.end = val_tmp + tmp_len; + + while (*(uintptr_t *) e.ip) { + code = *(ngx_http_script_code_pt *) e.ip; +@@ -771,6 +801,20 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + } + e.ip += sizeof(uintptr_t); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ val_len = e.pos - val_tmp; ++ ++ if (headers_end - b->last ++ < (ssize_t) (NGX_HTTP_V2_INT_OCTETS + val_len)) ++ { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "no buffer space in HTTP/2 create request"); ++ return NGX_ERROR; ++ } ++ + b->last = ngx_http_v2_write_value(b->last, val_tmp, val_len, tmp); + + #if (NGX_DEBUG) +@@ -894,6 +938,7 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + + e.ip = plcf->body_values->elts; + e.pos = b->last; ++ e.end = b->last + body_len; + e.request = r; + e.flushed = 1; + e.skip = 0; +@@ -903,6 +948,10 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c +index b4a73a5a6..7276b4a6f 100644 +--- a/src/http/modules/ngx_http_scgi_module.c ++++ b/src/http/modules/ngx_http_scgi_module.c +@@ -643,7 +643,7 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + { + off_t content_length_n; + u_char ch, sep, *key, *val, *lowcase_key; +- size_t len, key_len, val_len, allocated; ++ size_t len, params_len, key_len, val_len, allocated; + ngx_buf_t *b; + ngx_str_t content_length; + ngx_uint_t i, n, hash, skip_empty, header_params; +@@ -668,6 +668,7 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + + len = sizeof("CONTENT_LENGTH") + content_length.len + 1; + ++ params_len = 0; + header_params = 0; + ignored = NULL; + +@@ -705,8 +706,10 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + continue; + } + +- len += key_len + val_len + 1; ++ params_len += key_len + val_len + 1; + } ++ ++ len += params_len; + } + + if (scf->upstream.pass_request_headers) { +@@ -821,6 +824,7 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + + e.ip = params->values->elts; + e.pos = b->last; ++ e.end = b->last + params_len; + e.request = r; + e.flushed = 1; + +@@ -859,6 +863,10 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + #if (NGX_DEBUG) + val = e.pos; + #endif +@@ -866,6 +874,15 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + } ++ ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 1) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = '\0'; + e.ip += sizeof(uintptr_t); + +@@ -873,6 +890,12 @@ ngx_http_scgi_create_request(ngx_http_request_t *r) + "scgi param: \"%s: %s\"", key, val); + } + ++ if (e.pos != e.end) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "scgi request length mismatch"); ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +diff --git a/src/http/modules/ngx_http_try_files_module.c b/src/http/modules/ngx_http_try_files_module.c +index ce783a24d..bbdab8598 100644 +--- a/src/http/modules/ngx_http_try_files_module.c ++++ b/src/http/modules/ngx_http_try_files_module.c +@@ -78,7 +78,7 @@ ngx_module_t ngx_http_try_files_module = { + static ngx_int_t + ngx_http_try_files_handler(ngx_http_request_t *r) + { +- size_t len, root, alias, reserve, allocated; ++ size_t len, root, alias, reserve, allocated, n; + u_char *p, *name; + ngx_str_t path, args; + ngx_uint_t test_dir; +@@ -162,8 +162,15 @@ ngx_http_try_files_handler(ngx_http_request_t *r) + path.len = (name + tf->name.len - 1) - path.data; + + } else { ++ n = allocated; ++ ++ if (alias != NGX_MAX_SIZE_T_VALUE) { ++ n += (r->uri.len - alias); ++ } ++ + e.ip = tf->values->elts; + e.pos = name; ++ e.end = name + n; + e.flushed = 1; + + while (*(uintptr_t *) e.ip) { +@@ -171,6 +178,14 @@ ngx_http_try_files_handler(ngx_http_request_t *r) + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_HTTP_INTERNAL_SERVER_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 1) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + path.len = e.pos - path.data; + + *e.pos = '\0'; +diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c +index ecd6dd0d7..71a658c30 100644 +--- a/src/http/modules/ngx_http_uwsgi_module.c ++++ b/src/http/modules/ngx_http_uwsgi_module.c +@@ -866,7 +866,7 @@ static ngx_int_t + ngx_http_uwsgi_create_request(ngx_http_request_t *r) + { + u_char ch, sep, *lowcase_key; +- size_t key_len, val_len, len, allocated; ++ size_t key_len, val_len, len, params_len, allocated; + ngx_uint_t i, n, hash, skip_empty, header_params; + ngx_buf_t *b; + ngx_chain_t *cl, *body; +@@ -879,6 +879,7 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + ngx_http_script_len_code_pt lcode; + + len = 0; ++ params_len = 0; + header_params = 0; + ignored = NULL; + +@@ -916,8 +917,10 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + continue; + } + +- len += 2 + key_len + 2 + val_len; ++ params_len += 2 + key_len + 2 + val_len; + } ++ ++ len += params_len; + } + + if (uwcf->upstream.pass_request_headers) { +@@ -1049,6 +1052,7 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + + e.ip = params->values->elts; + e.pos = b->last; ++ e.end = b->last + params_len; + e.request = r; + e.flushed = 1; + +@@ -1081,12 +1085,24 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + continue; + } + ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = (u_char) (key_len & 0xff); + *e.pos++ = (u_char) ((key_len >> 8) & 0xff); + + code = *(ngx_http_script_code_pt *) e.ip; + code((ngx_http_script_engine_t *) &e); + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ ++ if (ngx_http_script_check_length(&e, 2) != NGX_OK) { ++ return NGX_ERROR; ++ } ++ + *e.pos++ = (u_char) (val_len & 0xff); + *e.pos++ = (u_char) ((val_len >> 8) & 0xff); + +@@ -1095,6 +1111,10 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + code((ngx_http_script_engine_t *) &e); + } + ++ if (e.status) { ++ return NGX_ERROR; ++ } ++ + e.ip += sizeof(uintptr_t); + + ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, +@@ -1103,6 +1123,12 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r) + val_len, e.pos - val_len); + } + ++ if (e.pos != e.end) { ++ ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, ++ "uwsgi request length mismatch"); ++ return NGX_ERROR; ++ } ++ + b->last = e.pos; + } + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 628e8f65b8..bcceedf820 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -9,6 +9,11 @@ SRC_URI:append = " \ file://CVE-2026-9256.patch \ file://CVE-2026-42055.patch \ file://CVE-2026-48142.patch \ + file://CVE-2026-42533_p1.patch \ + file://CVE-2026-42533_p2.patch \ + file://CVE-2026-42533_p3.patch \ + file://CVE-2026-42533_p4.patch \ + file://CVE-2026-42533_p5.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 8ba04167c2..1e0b889dcd 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -9,6 +9,11 @@ SRC_URI:append = " \ file://CVE-2026-9256.patch \ file://CVE-2026-42055.patch \ file://CVE-2026-48142.patch \ + file://CVE-2026-42533_p1.patch \ + file://CVE-2026-42533_p2.patch \ + file://CVE-2026-42533_p3.patch \ + file://CVE-2026-42533_p4.patch \ + file://CVE-2026-42533_p5.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100931 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4145CCA46C for ; Fri, 16 Oct 2026 03:21:02 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13829.1792120857841685084 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=PyZH5MbX; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4644; q=dns/txt; s=iport01; t=1792120858; x=1793330458; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=f3sHwzXof3eLH70O0mQVLJyuJm6l6M66GKmd6wOLqHs=; b=PyZH5MbXHo/lD7MV+GMWxqxHpgAgPe16qbZG9uSaHHVOsUYvFKAXVWaB 1BNA7L7WGC3OfzVgWyeUYb/V8rauZbhM0NX6sQcdmcCBYOQyGIjCapsRP K17LJypqXWOutikZwB0sQylrOPUNue3+gX44mJR67Tu/twOuItT8EdfQr LOF8nrQkIyO3g3u+BzS9ftVZtFHv4VKeVR6edpp3Vg2FhiiVbfsibMhP0 kBcQTSFMjPxLxF1j90K9EY7LLqSRtd8/QGRDkCBrJZ4kbqHvgZNChCGfA BEGNJ5sf696rQcmRo6Qm6cErWKHa8rh+Na8Gj5+LQeMDsOxqITzJxgZAS A==; X-CSE-ConnectionGUID: KkiLV0/BSOyAxu9rqHGoVw== X-CSE-MsgGUID: HTVclbeVQaC35HIC+7wmxA== X-IPAS-Result: A0CmAgBtltFq/5T/Ja1aglmCV3VgQ0kDjVeIBGwDnhwUgWoPAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxEGvHOBeTOBAYMpAYFU2zIBCxQBBYEzhUCII10YAYR8JxsbgXKBFYNpgQWBXAEBAYFGhl4EgiKBDIFaiDmNDkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5ITHoJeBz1RARMWAQGBNBEmk1KSZKEPCiiDdowilToaM6pvC5h9jgqVf1CEaYFoPIFZcBWDIglKGQ+OLgEKC4NghRPJRycyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:qbJEAKA2yb63eBVW/3jiw5YqxClBgxIJ4kV8jS/XYbTApDtw0TRTm zBLXT2FbPncNzSkLot0btzl9koAu5LWn98xOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQf8hWYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE4PZvKH9ueqcj3fdeEXwf7 +U4BzczcUXW7w626OrTpuhEnM8vKozveYgYoHwllGifBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY/BPjDS0Un1lM/CI4+leShnFH0ciZTrxSeoq9fD237kVYogeaybYWEEjCMbeVpoE2cr G/4xm3SWUw6FffcliWA4lv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFe2v/S9okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/ONpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOf9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:F7pdEahTwT2Xd3mDrwjtcrDV8HBQXgIji2hC6mlwRA09TyVXra +TdZMgpHjJYVkqOU3I9ersBEDEewK/yXcX2/h0AV7dZmnbUQKTRekIh7cKgQeQfhEWndQy6U 4PScRD4fTLfD5HZL7BkWqFOudl5sWb+6a1guqb5XJsQQZ2L5xE1W5Ce3+m+okcfng8OXL/f6 DsnvZ6mw== X-Talos-CUID: 9a23:o1jFNmONI9206e5Deypm0HBMXeoeVWz03GqBOVaYJmFXV+jA X-Talos-MUID: 9a23:VVIFyQbJBCyaXeBTlwPSjzVoOflR6o/1VWAsutZZpMyUHHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="521967579" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 412181800024A; Fri, 16 Oct 2026 03:20:57 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 9411DCBEFBF; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 09/11] nginx: fix CVE-2026-56434 Date: Thu, 15 Oct 2026 20:20:54 -0700 Message-Id: <20261016032056.409095-10-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131032 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2 [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar --- .../nginx/files/CVE-2026-56434.patch | 71 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 3 files changed, 73 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-56434.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-56434.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-56434.patch new file mode 100644 index 0000000000..ccf19a7745 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-56434.patch @@ -0,0 +1,71 @@ +From ddde692db11ab8238e9ca661007f64c9f6d764d2 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Mon, 29 Jun 2026 21:49:27 +0400 +Subject: [PATCH] Avoid duplicate subrequest finalization + +Previously, if a subrequest was posted twice, it could be finalized in +both calls, excessively reducing r->main->count and potentially leading +to a use-after-free. + +The fix is to avoid posting a request if it's already posted. Also, +as a hardening measure, r->write_event_handler is now reset to a no-op +handler during active subrequest finalization. + +The problem manifests itself in ngx_http_ssi_filter_module during +unbuffered proxying. If a subrequest is created for an SSI include +statement while the main request has some data postponed by another +include, this subrequest becomes double-posted when the main request +data is flushed. The first post comes from ngx_http_subrequest() and +the second one comes from ngx_http_postpone_filter(). In case of a +quick subrequest finalization, the above mentioned problem happens. + +Reported by P4P3R-HAK. + +CVE: CVE-2026-56434 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2] + +(cherry picked from commit ddde692db11ab8238e9ca661007f64c9f6d764d2) +Signed-off-by: Hetvi Thakar +--- + src/http/ngx_http_request.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c +index ceac8d307..6dc275757 100644 +--- a/src/http/ngx_http_request.c ++++ b/src/http/ngx_http_request.c +@@ -2501,6 +2501,14 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr) + { + ngx_http_posted_request_t **p; + ++ for (p = &r->main->posted_requests; *p; p = &(*p)->next) { ++ if ((*p)->request == r) { ++ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, ++ "http request already posted"); ++ return NGX_OK; ++ } ++ } ++ + if (pr == NULL) { + pr = ngx_palloc(r->pool, sizeof(ngx_http_posted_request_t)); + if (pr == NULL) { +@@ -2511,8 +2519,6 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr) + pr->request = r; + pr->next = NULL; + +- for (p = &r->main->posted_requests; *p; p = &(*p)->next) { /* void */ } +- + *p = pr; + + return NGX_OK; +@@ -2632,6 +2638,8 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc) + + r->main->count--; + ++ r->write_event_handler = ngx_http_request_empty_handler; ++ + if (pr->postponed && pr->postponed->request == r) { + pr->postponed = pr->postponed->next; + } +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index bcceedf820..56050b84eb 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -14,6 +14,7 @@ SRC_URI:append = " \ file://CVE-2026-42533_p3.patch \ file://CVE-2026-42533_p4.patch \ file://CVE-2026-42533_p5.patch \ + file://CVE-2026-56434.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 1e0b889dcd..68015a12fa 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -14,6 +14,7 @@ SRC_URI:append = " \ file://CVE-2026-42533_p3.patch \ file://CVE-2026-42533_p4.patch \ file://CVE-2026-42533_p5.patch \ + file://CVE-2026-56434.patch \ " # 1.28.x branch is the current stable branch, the recommended default From patchwork Fri Oct 16 03:20:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100929 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53A6BCCA462 for ; Fri, 16 Oct 2026 03:21:02 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13830.1792120858226826201 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=WgIfzpXN; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2189; q=dns/txt; s=iport01; t=1792120858; x=1793330458; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=z9ldcdWry9ahD51h1bDHzgZumiyf8SbsHDoo33U9Zkg=; b=WgIfzpXNQobRKl/Wj53LUSdQbrLiFunJuPXSGQFe+gETV6G8rps9GN6e osWH6xvbXPgbbgylLQPREhkLHKnldAx79a3RavWhAVQ/A+Wh12cI634A7 V3yf1EpMMarP9dE6UNmuCnlNmRo48FAfDcGnczs8hzrCN/v2ZaiNtxzS/ 0GUdAOYiTLwOukzE9pBnso6cPe+LrOiTbAJHCYb7P/coY4ObV056GlV07 JyvpCcWYXvgnWe4MmqKDqlP8gpump6+4I/ZvYYDCgIConQcN4Z4xFPIXQ OXdU5laPo85xeRstv9RxnwrqGHsUas4bZPaCREyayWB9Qi/m60zApWO2q g==; X-CSE-ConnectionGUID: 0DZgIDSuS1eCHBnXN0UW7g== X-CSE-MsgGUID: S+ANA0+0SNmGgATAHTvSng== X-IPAS-Result: A0B2AwCRl9Fq/5X/Ja1aglmCV3VgQ0kDjVeIBGwDnhyBfg8BAQEPPRQEAQGFBQKOFQImNgcOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEwIBAzIBGAEtECAxKysZgwIBgnQDEQa8dIIsgQGDKQFDQVDbMgELFAEFgTOFQIgjdQGEfCcbG4FygRWDaYEFgVwBAoIshXgEgiKBDIF4lSlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSEx6CZWEtASkBAQSCAaYcoQ8KKIN2jCKVOhozqm8LmH2OCpZPhGmBbwgtgVlwFYMiCUoZD44vCguIc8lHJzICDC8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:PLEbXK49Bikg1FPJYneYcwxRtGnGchMFZxGqfqrLsTDasY5as4F+v mYXDGmEOP+JZTT8fdh3aY+z9RwE6sSDz9FqGgNoqylmZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eZaEq9cdbOnx1r PEzCBoLXjbbut3pz+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGMqFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEeUrsUIMpWcOOAhmX/ej5RsnqepLE85C7YywkZPL3FbYGIK4zWFJ8F9qqej lmF1kLQWlJCD/qa5jWszluMuvH0myyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0KzRd9bA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzFeCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:yt/kEav3K6WMvqqHnRusGM0F7skDrtV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWIeeAa2SS9fyKgzWQIpIH3MSN9ryuiKP1yndgShwvVoRbhj0Jczpy1iZNNXJ77V1TLu vl2vZ6 X-Talos-CUID: 9a23:tapUyW8yJp5k8lFKe9KVvxY4KM8EXkbA9y7dCG+SD1ZPEICqFlDFrQ== X-Talos-MUID: 9a23:7QVWVwYffDCp++BTjHzFohg6d59TxaGBB2kxuLU6pfKCOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535984928" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 4023518000301; Fri, 16 Oct 2026 03:20:57 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 97D1ACBEF6B; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 10/11] nginx: Ignore CVE-2026-40460 Date: Thu, 15 Oct 2026 20:20:55 -0700 Message-Id: <20261016032056.409095-11-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131029 From: Hetvi Thakar Analysis: - CVE-2026-40460 affects nginx only when the HTTP/3 QUIC module is enabled [1]. - The module requires the explicit --with-http_v3_module configure option, which neither Wrynose nginx recipe enables by default [2]. - Mark the CVE not applicable only when that option is absent; report it as unpatched when a bbappend enables the module. Reference: [1] https://nginx.org/en/security_advisories.html [2] https://nginx.org/en/docs/configure.html Signed-off-by: Hetvi Thakar --- meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb | 1 + meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 2 files changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 56050b84eb..ca8e7129fb 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -23,3 +23,4 @@ SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1" CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2" +CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 68015a12fa..2aae2091a0 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -25,3 +25,4 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99" SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139" +CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}" From patchwork Fri Oct 16 03:20:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100936 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3964CCA490 for ; Fri, 16 Oct 2026 03:21:03 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14025.1792120857867434225 for ; Thu, 15 Oct 2026 20:20:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=QHoTMpT5; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2710; q=dns/txt; s=iport01; t=1792120858; x=1793330458; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4OX8hJLE/24o/jomIPkOIuJmt8YTChzpUsmZl7l9NOI=; b=QHoTMpT5Ym3G/+YbmdNiD3tOV5Kzv7iGwTLUx/exBkerX9tKMTto5A2C Aej7JQyBPoKovJ4NmpN5wt/y48jNaYf4BmmaVKjakywyvi66r+kecvnRL XVdjvOvL1kupbwL6FxeeOLEFckDdQDW6Sx2OAcHVklpplzWwBSPIm8fs6 dVUMXyW8MAqMjYOev5OR4bJE2lva7C2SxAeuGUsKbxyX+GHe60jlI1/Tx 9WJjkq415ERMIukpZBraRo0o8uPN9xWAWi8LxAqESyLB7JPUB25pW9CIv 0UyRNp8j8cFanYpB25K/UAZ51CPapBhKp1/dxXYTXCWZpuGtfKDm5LZZ3 Q==; X-CSE-ConnectionGUID: PIrYxVWDS8izngKjGfDQvw== X-CSE-MsgGUID: Txeoo1KnTsqSrQeYKiquKw== X-IPAS-Result: A0D8AgCRl9Fq/5P/Ja1aglmCV3VgQ0mVXmwDnhyBfg8BAQEPPRQEAQGFBQKOFQImNgcOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEwIBAzIBGAEtECAxKysZgwIBgnQDEQa8dIIsgQGDKQFDQVDbMgELFAEFgTOFQIgjdQGEfCcbG4FygRWDaYEFgVwBAQGCLIV4BIIigQyBeJUpSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhMegmVhLQEpAgSCAaYcoQ8KKIN2jCKVOhozqm8LmH2OCpZPhGmBbwMygVlwFYMiCUoZD44vCguDYIUTyUcnMgI7AQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:Ft/t66JBAPPNG1evFE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS0jVTn DcaDTzQPKnbMzTzeNpzOouw9BgFv5/TyNZiTAEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1WLVsHLbMn1t0nAHNI+ t8aBz4hVw6c0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVbAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEuojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsi+a0bIGJJ43iqcN9olaVo WWf3GLFGQghLuWS+BmE62+Pmbqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+rfSnh0qWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRul7fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9ExpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:BylQBKnU3ZOkbVkby5YMujKiNAPpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:tx9W42stUp6L2LblrTdBoGAt6IsdU2fs3EnvD3ToCHRvR56XZlG8wb17xp8= X-Talos-MUID: 9a23:23T4tgzFPKjJClBsJdCyhcbC5H2aqJi+BUcKyLYAh9KdDjZJNga+jS2qYZByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536143459" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:20:57 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 40BE218000899; Fri, 16 Oct 2026 03:20:57 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 9B2BACBEF6C; Thu, 15 Oct 2026 20:20:56 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 11/11] nginx: Ignore CVE-2026-60005 Date: Thu, 15 Oct 2026 20:20:56 -0700 Message-Id: <20261016032056.409095-12-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:21:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131028 From: Hetvi Thakar Analysis: - CVE-2026-60005 affects the optional ngx_http_slice_module [1]. - The slice module is not built by default and requires the explicit --with-http_slice_module configure option, which neither Wrynose nginx recipe enables by default [1][2]. - Mark the CVE not applicable only when that option is absent; report it as unpatched when a bbappend enables the module. Reference: [1] https://github.com/advisories/GHSA-vxcv-h5wj-jxr5 [2] https://nginx.org/en/docs/configure.html Signed-off-by: Hetvi Thakar --- meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb | 1 + meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 2 files changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index ca8e7129fb..d087ae8804 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -24,3 +24,4 @@ SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1" CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2" CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}" +CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 2aae2091a0..3b57994069 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -26,3 +26,4 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99" SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139" CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}" +CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }"