import UBI nginx-1.26.3-9.module+el9.8.0+24599+8fde0ff7.3

SOURCES/0019-Avoid-duplicate-subrequest-finalization.patch

@@ -0,0 +1,66 @@
+From b9272dea42e77c9b2dd877b1f0da42ad93a45abc Mon Sep 17 00:00:00 2001
+From: Roman Arutyunyan <arut@nginx.com>
+Date: Mon, 29 Jun 2026 21:49:27 +0400
+Subject: [PATCH] Avoid duplicate subrequest finalization
+
+Previously, if a subrequest was posted twice, it could be finalized in
+both calls, excessively reducing r->main->count and potentially leading
+to a use-after-free.
+
+The fix is to avoid posting a request if it's already posted.  Also,
+as a hardening measure, r->write_event_handler is now reset to a no-op
+handler during active subrequest finalization.
+
+The problem manifests itself in ngx_http_ssi_filter_module during
+unbuffered proxying.  If a subrequest is created for an SSI include
+statement while the main request has some data postponed by another
+include, this subrequest becomes double-posted when the main request
+data is flushed.  The first post comes from ngx_http_subrequest() and
+the second one comes from ngx_http_postpone_filter().  In case of a
+quick subrequest finalization, the above mentioned problem happens.
+
+Reported by P4P3R-HAK.
+---
+ src/http/ngx_http_request.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
+index 88165b4..3297b2a 100644
+--- a/src/http/ngx_http_request.c
++++ b/src/http/ngx_http_request.c
+@@ -2524,6 +2524,14 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr)
+ {
+     ngx_http_posted_request_t  **p;
+ 
++    for (p = &r->main->posted_requests; *p; p = &(*p)->next) {
++        if ((*p)->request == r) {
++            ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
++                           "http request already posted");
++            return NGX_OK;
++        }
++    }
++
+     if (pr == NULL) {
+         pr = ngx_palloc(r->pool, sizeof(ngx_http_posted_request_t));
+         if (pr == NULL) {
+@@ -2534,8 +2542,6 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr)
+     pr->request = r;
+     pr->next = NULL;
+ 
+-    for (p = &r->main->posted_requests; *p; p = &(*p)->next) { /* void */ }
+-
+     *p = pr;
+ 
+     return NGX_OK;
+@@ -2655,6 +2661,8 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
+ 
+             r->main->count--;
+ 
++            r->write_event_handler = ngx_http_request_empty_handler;
++
+             if (pr->postponed && pr->postponed->request == r) {
+                 pr->postponed = pr->postponed->next;
+             }
+-- 
+2.44.0
+

SOURCES/0020-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch

@@ -0,0 +1,51 @@
+From 75127b10adabca706e7d393c9012c02ea088f459 Mon Sep 17 00:00:00 2001
+From: Pavel Pautov <p.pautov@f5.com>
+Date: Fri, 15 May 2026 00:48:50 -0700
+Subject: [PATCH] Fixed uninitialized memory read caused by stale regex
+ captures.
+
+When ngx_http_regex_exec() reallocates r->captures array, it doesn't update
+r->ncaptures value, if regex didn't match. So the next use of unnamed regex
+capture triggers uninitialized read and potential buffer overrun.
+
+This config demonstrates the issue:
+    map test $my_map {
+        volatile;
+
+        ~mismatch(.*) 1; # reallocates r->captures in subrequests
+
+        default "";
+    }
+
+    server {
+        location ~(.*) { # sets r->ncaptures
+            slice 50;
+
+            # $1 will read from uninitialized memory in slice subrequests
+            proxy_set_header Test $my_map$1;
+
+            proxy_set_header Range $slice_range;
+            proxy_pass http://backend;
+        }
+    }
+
+The issue was introduced by 746fba0d79c6.
+---
+ src/http/ngx_http_variables.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
+index 4f0bd0e..bcd6481 100644
+--- a/src/http/ngx_http_variables.c
++++ b/src/http/ngx_http_variables.c
+@@ -2626,6 +2626,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
+ 
+         if (r->captures == NULL || r->realloc_captures) {
+             r->realloc_captures = 0;
++            r->ncaptures = 0;
+ 
+             r->captures = ngx_palloc(r->pool, len * sizeof(int));
+             if (r->captures == NULL) {
+-- 
+2.44.0
+

SPECS/nginx.spec

@@ -67,7 +67,7 @@
 Name:              nginx
 Epoch:             2
 Version:           1.26.3
-Release:           9%{?dist}.2
+Release:           9%{?dist}.3
 
 Summary:           A high performance web server and reverse proxy server
 License:           BSD-2-Clause
@@ -165,6 +165,14 @@ Patch16:           0017-Added-max_headers-directive.patch
 # upstream patch - https://github.com/nginx/nginx/commit/26d824ec3a2f819300edce0ab3b055751c9843ff.patch
 Patch17:           0018-Upstream-limit-header-length-for-HTTP-2-and-gRPC.patch
 
+# https://redhat.atlassian.net/browse/RHEL-219313
+# upstream patch - https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2.patch
+Patch18:           0019-Avoid-duplicate-subrequest-finalization.patch
+
+# https://redhat.atlassian.net/browse/RHEL-217956
+# upstream patch - https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336.patch
+Patch19:           0020-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch
+
 BuildRequires:     make
 BuildRequires:     gcc
 BuildRequires:     gnupg2
@@ -691,6 +699,9 @@ fi
 
 %changelog
 ## START: Generated by rpmautospec
+* Mon Aug 03 2026 Luboš Uhliarik <luhliari@redhat.com> - 2:1.26.3-13
+- Fixes CVE-2026-56434 and CVE-2026-60005
+
 * Tue Jul 07 2026 Luboš Uhliarik <luhliari@redhat.com> - 2:1.26.3-12
 - Resolves: RHEL-191774 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI
   causing crashes