Debian Patches

Status for nginx/1.30.4-8

Patch Description Author Forwarded Bugs Origin Last update
nginx-fix-pidfile.patch Fix NGINX pidfile handling Tj <ubuntu@iam.tj> no debian 2020-06-24
nginx-ssl_cert_cb_yield.patch # HG changeset patch
# User Yichun Zhang <agentzh@openresty.org>
# Date 1451762084 28800
# Sat Jan 02 11:14:44 2016 -0800
# Node ID 449f0461859c16e95bdb18e8be6b94401545d3dd
# Parent 78b4e10b4367b31367aad3c83c9c3acdd42397c4

OpenSSL 1.0.2+ introduces SSL_CTX_set_cert_cb() to allow custom
callbacks to serve the SSL certificiates and private keys dynamically
and lazily. The callbacks may yield for nonblocking I/O or sleeping.
Here we added support for such usage in NGINX 3rd-party modules
(like ngx_lua) in NGINX's event handlers for downstream SSL
connections.

===================================================================		 no https://github.com/openresty/openresty/blob/master/patches/nginx-1.21.4-ssl_cert_cb_yield.patch
override-uname.patch Override uname probing during configure Miao Wang <shankerwangmiao@gmail.com> no 2025-02-13
fix-cache-line-size-for-loongarch64.patch Configure: set cache line size for loongarch64
Section 8.2 table 54, registers 0x11 - 0x14 (2^6 = 64 bytes)
<https://loongson.github.io/LoongArch-Documentation/Loongson-3A5000-usermanual-EN.html#instruction-set-features-implemented-in-3a5000>

There is no intent to cover 32-bit LoongArch which acceptably falls
through to the default.		 Miao Wang <shankerwangmiao@users.noreply.github.com> not-needed https://github.com/nginx/nginx/commit/be84ac8bda2265d254f3ead9c3f0ba1d78a79319 2026-06-22
CVE-2026-90439.patch QUIC: registering the compat extension in all SSL contexts
With the OpenSSL compatibility layer, the transport parameters custom
TLS extension used to be registered only in SSL contexts of virtual
servers reachable over QUIC.

The ClientHello callback introduced in 0373fe5d9 (1.29.2) is called
by OpenSSL between collecting and parsing extensions, so the custom
extensions may not match the expected number if the SSL context was
replaced with SSL_set_SSL_CTX().

The fix is to register the extension in all SSL contexts, including
those that cannot be reached over QUIC, so that the array bounds are
preserved; the compatibility layer as a whole is initialized only
if the configuration has QUIC listeners. The keylog callback,
meaningful for QUIC connections, is kept on QUIC addresses.

Reported by Banny Liao.

Debian backport note:
Keep ngx_quic_compat_init() and the public ngx_event_quic_openssl_compat.h
unchanged for nginx-dev ABI compatibility. Put new declarations in a
private .hh header.		 Sergey Kandaurov <pluknet@nginx.com> no https://github.com/nginx/nginx/commit/78399582a5d6d212e40ffc7f9ca61e6de7852d9c 2026-09-08
CVE-2026-15176.patch Avoid post-rewrite URI to path mapping with alias
Previously, after a "rewrite" had changed the URI, and before a new
location was chosen, the new URI might not match the current location
prefix. This becomes a problem when the location uses "alias", which
is why normally such inconsistency is detected by checking the
r->valid_location flag. Meanwhile this flag only handles the
inconsistency when using the "break" directive or parameter. However
in absence of those, there's still an inconsistency window from URI
change up until the end of the current set of rewrite directives.
URI to path mapping within this window might result in a buffer
overflow if location's prefix was longer than the rewritten URI.

The following example resulted in a buffer overflow with the request
"/foo/1":

location /foo/ {
alias /bar/;
rewrite ^/foo/.*$ /x;
return 200 $request_filename;
}

Alternatively, $request_filename might be used in access log format,
"set", "if", "add_header", etc.

The fix is to reject URI mapping in ngx_http_map_uri_to_path() if the
r->uri_changed flag is set.

CVE-2026-15176		 Roman Arutyunyan <arut@nginx.com> no https://github.com/nginx/nginx/commit/ce1da78900b07e72f37a25f55e6606220ac45902 2026-07-10
CVE-2026-93479.patch Script: reserved memory overrun protection in ngx_http_script_run()

In b76754049 buffer overrun protection in script was introduced.
However in ngx_http_script_run() data could still spill over to the
reserved area. This had no visible effects except the return value
which could extend beyond the maximum formatted string size. This
value is however currently unused in the nginx code.

Later in a8289aa69 string length recalculation was implemented to
protect against buffer underwrite. Considering a possible spillover to
the reserved area, the final string size could become larger than the
allocated buffer size. This could later result in writing beyond
the buffer boundaries. Maximum buffer overflow is the size of the
reserved area.

This could affect calculating document root from variables in HTTP
or using access logging in HTTP or Stream. In the case of access
logging a possible impact is limited by an off-by-one write of a null
byte.

Reported by Matt Suiche of Tolmo Inc.

CVE-2026-93479		 Roman Arutyunyan <arut@nginx.com> no https://github.com/nginx/nginx/commit/7abb1b4009fdf63e17a1721a932295714eb1fbb7 2026-07-29
CVE-2026-95101.patch HTTP/3: kept the skipped frame length separate from data length

ngx_http_v3_parse_data() stored the remaining length of a skipped
(unknown) frame in st->length -- the same field the request body
filter uses for the number of DATA payload bytes to pass on as
request body. When an unknown frame was split across parser
invocations, the skip was interrupted with st->length holding the
skip remainder; on the next buffer the body filter, which calls
the parser only while st->length == 0, treated that remainder as
request body.

When proxying, this could result in sending unframed bytes, potentially
allowing for bypass of client_max_body_size, which is enforced only on
the DATA path, or an injection.

The fix is to keep unknown frame payload in a separate st->skip counter.

Reported by Hansol Lee of GOTROOT.

CVE-2026-95101

Debian backport note:
Keep ngx_http_v3_parse_data_t unchanged for nginx-dev ABI compatibility.
Reuse st->type as the skip counter while in sw_skip: the unknown frame
type is no longer needed, and sw_type overwrites it for the next frame.
Keep st->length zero while skipping, as in the upstream fix.		 Vadim Zhestikov <v.zhestikov@f5.com> no https://github.com/nginx/nginx/commit/90b30edffea4f427608c36e3849643b6f9841bc4 2026-07-22
CVE-2026-97629.patch SSL: synced all session ticket keys to the worker process
The per-worker ticket key mirror is allocated with three slots
(ngx_array_push_n(keys, 3)), matching the shared memory
ticket_keys[3] array and the decrypt callback, which scans all
keys->nelts slots by key name. Key rotation, however, synced
only two slots from shared memory, leaving the third slot's
name, hmac_key, and aes_key uninitialized.

A ticket whose key name matched the uninitialized slot (which
holds unspecified pool memory, all zero in the best case) could
therefore be HMAC-verified and decrypted with uninitialized key
material, allowing a forged session.

Sync all keys->nelts slots, as ngx_ssl_ticket_keys_cleanup()
already assumes.

Reported by PhiNode Labs.

CVE-2026-97629		 Vadim Zhestikov <v.zhestikov@f5.com> no https://github.com/nginx/nginx/commit/fdedba031bf1ad6a80c61b1aec1418d1a87ae296 2026-07-22
CVE-2026-97205.patch Limited the number of pending operations per request
Each pending asynchronous operation holds a reference in
r->main->blocked, an 8-bit field, and the increments were not checked.
With 256 operations pending on a single request the counter wrapped to
zero, after which the request could be freed while those operations
still referenced its pool. This is the same overflow that 4ec67cf86
addressed for r->main->count, and left unaddressed for r->main->blocked.

Operations beyond the limit are now performed synchronously where a
synchronous path exists, and refused otherwise, so that the counter
cannot overflow.

Reported by cyberlancer.

CVE-2026-97205

Debian backport note:
Keep the public ngx_http_request.h unchanged for nginx-dev header
compatibility. Put NGX_HTTP_MAX_BLOCKED in a private .hh header.
The request structure and its 8-bit blocked counter remain unchanged.		 Vadim Zhestikov <v.zhestikov@f5.com> no https://github.com/nginx/nginx/commit/587c47aed19ddec799eee953a38837936e585b39 2026-08-17

All known versions for source package 'nginx'

Links