Repository navigation
fix: Security patches for CVE-2026-42945, CVE-2026-42946, CVE-2026-42934, CVE-2026-40701 - #2027
Merged
Merged
Conversation
Rewrite: fixed escaping and possible buffer overrun. If there were arguments in a rewrite's replacement string, the is_args flag was set and incorrectly never cleared. This resulted in escaping applied to any captures evaluated afterwards in set or if. Additionally buffer was allocated by ngx_http_script_complex_value_code() without escaping expected, thus this also resulted in buffer overrun and possible segfault. Fix: reset e->is_args to 0 in ngx_http_script_regex_end_code() after each rewrite directive completes, preventing the flag from leaking to subsequent directives. Based on official nginx fix: nginx/nginx@524977e Affected: NGINX 0.6.27 - 1.30.0 CVSS: 9.2 (Critical)
…_http_uwsgi_module Upstream: reset parsing state after invalid status line. Upstream: fixed parsing of split status lines. Previously, it was possible to start parsing headers with a wrong parsing state after status line was not recognized, as a fallback used in the scgi and uwsgi modules. Additionally, if the first response line was split across reads and it didn't appear a status line, the portion already processed was lost, leading to a heap memory buffer overread. Fix: save buffer position before calling ngx_http_parse_status_line() using r->header_name_start, reset r->state to 0 on fallback, and restore u->buffer.pos for proper backtracking when status line parsing fails. Based on official nginx fixes: nginx/nginx@baef7fd nginx/nginx@39d7d0b Affected: NGINX 0.8.42 - 1.30.0 CVSS: 8.3 (High)
Charset: fix buffer over-read in recode_from_utf8(). When a multi-byte UTF-8 character was split across 3+ single-byte buffers, the saved bytes continuation path had two related bugs: ngx_utf8_decode() was called with the last saved-array index instead of the byte count, causing it to report 'incomplete' even when the sequence was already complete. The subsequent ngx_memcpy() used that same index as the copy length, reading past the input buffer boundary. Fix: replace the for-loop with a direct ngx_memcpy() using ngx_min() to calculate the correct number of bytes to copy, then pass the proper total length to ngx_utf8_decode(). Update the incomplete-sequence path to simply set ctx->saved_len = len since bytes are already copied. Based on official nginx fix: nginx/nginx@54b7945 Affected: NGINX 0.3.50 - 1.30.0 CVSS: Low severity
…l_module OCSP: resolve cleanup on connection close. Previously, when a client SSL connection was terminated (typically due to a timeout) while resolving an OCSP responder, the OCSP context was freed, but the resolve context was not. This resulted in use-after-free on resolve completion. Fix: Add a 'resolve' field to ngx_ssl_ocsp_ctx_s to track the outstanding DNS resolution. In ngx_ssl_ocsp_done(), cancel any pending resolution by calling ngx_resolve_name_done() before destroying the pool. Save the resolve pointer in ngx_ssl_ocsp_request() and clear it in both success and failure paths of ngx_ssl_ocsp_resolve_handler(). Based on official nginx fix: nginx/nginx@d2b8d47 Affected: NGINX 1.19.0 - 1.30.0 CVSS: 6.3 (Medium)
|
大佬们，请问什么时候修复一下这个漏洞CVE-2026-28755 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport security fixes from nginx 1.30.1 for four CVEs affecting the nginx core used in Tengine.
CVEs Fixed
CVE-2026-42945 - Heap buffer overflow in ngx_http_rewrite_module (Critical, CVSS 9.2)
If there were arguments in a rewrite's replacement string, the
is_argsflag was set and never cleared. This caused escaping to be incorrectly applied to captures evaluated in subsequentsetorifdirectives. Since the buffer was allocated without expecting escaping, this resulted in a heap buffer overrun and possible remote code execution.Fix: Reset
e->is_argsto 0 inngx_http_script_regex_end_code().Based on: nginx/nginx@524977e
CVE-2026-42946 - Buffer overread in ngx_http_scgi_module and ngx_http_uwsgi_module (High, CVSS 8.3)
When the first response line from an SCGI/uWSGI backend was not a valid HTTP status line, the fallback to header parsing could start with a wrong parsing state. Additionally, if the status line was split across reads, the already-processed portion was lost on fallback, leading to buffer overread.
Fix: Reset
r->stateto 0 on fallback, save buffer position before parsing usingr->header_name_start, and restoreu->buffer.posfor proper backtracking.Based on: nginx/nginx@baef7fd and nginx/nginx@39d7d0b
CVE-2026-42934 - Buffer overread in ngx_http_charset_module (Low)
When a multi-byte UTF-8 character was split across 3+ single-byte buffers,
ngx_utf8_decode()was called with the wrong byte count (last saved-array index instead of total length), and the subsequentngx_memcpy()could read past the input buffer boundary.Fix: Replace the for-loop with a direct
ngx_memcpy()usingngx_min()to calculate the correct copy length, and pass the proper total length tongx_utf8_decode().Based on: nginx/nginx@54b7945
CVE-2026-40701 - Use-after-free in OCSP resolver (Medium, CVSS 6.3)
When a client SSL connection was terminated while resolving an OCSP responder hostname, the OCSP context was freed but the resolver context was not. This resulted in use-after-free when the DNS resolution completed.
Fix: Track the resolver context in
ngx_ssl_ocsp_ctx_sand cancel any pending resolution inngx_ssl_ocsp_done().Based on: nginx/nginx@d2b8d47
Files Changed
src/http/ngx_http_script.csrc/http/modules/ngx_http_scgi_module.csrc/http/modules/ngx_http_uwsgi_module.csrc/http/modules/ngx_http_charset_filter_module.csrc/event/ngx_event_openssl_stapling.cTesting
All fixes are minimal and match the official nginx 1.30.1 patches. No functional behavior changes beyond the security fixes.