diff --git a/0016-Avoid-duplicate-subrequest-finalization.patch b/0016-Avoid-duplicate-subrequest-finalization.patch new file mode 100644 index 0000000..9cd8d60 --- /dev/null +++ b/0016-Avoid-duplicate-subrequest-finalization.patch @@ -0,0 +1,66 @@ +From 99fedfd7e0726e062dffdf76371a0ee73c6d5c0a Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Mon, 29 Jun 2026 21:49:27 +0400 +Subject: [PATCH] Avoid duplicate subrequest finalization + +Previously, if a subrequest was posted twice, it could be finalized in +both calls, excessively reducing r->main->count and potentially leading +to a use-after-free. + +The fix is to avoid posting a request if it's already posted. Also, +as a hardening measure, r->write_event_handler is now reset to a no-op +handler during active subrequest finalization. + +The problem manifests itself in ngx_http_ssi_filter_module during +unbuffered proxying. If a subrequest is created for an SSI include +statement while the main request has some data postponed by another +include, this subrequest becomes double-posted when the main request +data is flushed. The first post comes from ngx_http_subrequest() and +the second one comes from ngx_http_postpone_filter(). In case of a +quick subrequest finalization, the above mentioned problem happens. + +Reported by P4P3R-HAK. +--- + src/http/ngx_http_request.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c +index 88165b4..3297b2a 100644 +--- a/src/http/ngx_http_request.c ++++ b/src/http/ngx_http_request.c +@@ -2524,6 +2524,14 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr) + { + ngx_http_posted_request_t **p; + ++ for (p = &r->main->posted_requests; *p; p = &(*p)->next) { ++ if ((*p)->request == r) { ++ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, ++ "http request already posted"); ++ return NGX_OK; ++ } ++ } ++ + if (pr == NULL) { + pr = ngx_palloc(r->pool, sizeof(ngx_http_posted_request_t)); + if (pr == NULL) { +@@ -2534,8 +2542,6 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr) + pr->request = r; + pr->next = NULL; + +- for (p = &r->main->posted_requests; *p; p = &(*p)->next) { /* void */ } +- + *p = pr; + + return NGX_OK; +@@ -2655,6 +2661,8 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc) + + r->main->count--; + ++ r->write_event_handler = ngx_http_request_empty_handler; ++ + if (pr->postponed && pr->postponed->request == r) { + pr->postponed = pr->postponed->next; + } +-- +2.44.0 + diff --git a/0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch b/0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch new file mode 100644 index 0000000..1d02a6c --- /dev/null +++ b/0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch @@ -0,0 +1,51 @@ +From cfba8763e231c6ee5ab11cc5b092a04c314c9db4 Mon Sep 17 00:00:00 2001 +From: Pavel Pautov +Date: Fri, 15 May 2026 00:48:50 -0700 +Subject: [PATCH] Fixed uninitialized memory read caused by stale regex + captures. + +When ngx_http_regex_exec() reallocates r->captures array, it doesn't update +r->ncaptures value, if regex didn't match. So the next use of unnamed regex +capture triggers uninitialized read and potential buffer overrun. + +This config demonstrates the issue: + map test $my_map { + volatile; + + ~mismatch(.*) 1; # reallocates r->captures in subrequests + + default ""; + } + + server { + location ~(.*) { # sets r->ncaptures + slice 50; + + # $1 will read from uninitialized memory in slice subrequests + proxy_set_header Test $my_map$1; + + proxy_set_header Range $slice_range; + proxy_pass http://backend; + } + } + +The issue was introduced by 746fba0d79c6. +--- + src/http/ngx_http_variables.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c +index 4f0bd0e..bcd6481 100644 +--- a/src/http/ngx_http_variables.c ++++ b/src/http/ngx_http_variables.c +@@ -2626,6 +2626,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s) + + if (r->captures == NULL || r->realloc_captures) { + r->realloc_captures = 0; ++ r->ncaptures = 0; + + r->captures = ngx_palloc(r->pool, len * sizeof(int)); + if (r->captures == NULL) { +-- +2.44.0 + diff --git a/nginx.spec b/nginx.spec index 39d53b0..5210799 100644 --- a/nginx.spec +++ b/nginx.spec @@ -62,7 +62,7 @@ Name: nginx Epoch: 2 Version: 1.26.3 -Release: 6%{?dist}.5 +Release: 6%{?dist}.6 Summary: A high performance web server and reverse proxy server License: BSD-2-Clause @@ -151,6 +151,14 @@ Patch13: 0014-Added-max_headers-directive.patch # upstream patch - https://github.com/nginx/nginx/commit/26d824ec3a2f819300edce0ab3b055751c9843ff.patch Patch14: 0015-Upstream-limit-header-length-for-HTTP-2-and-gRPC.patch +# https://redhat.atlassian.net/browse/RHEL-219313 +# upstream patch - https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2.patch +Patch15: 0016-Avoid-duplicate-subrequest-finalization.patch + +# https://redhat.atlassian.net/browse/RHEL-217956 +# upstream patch - https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336.patch +Patch16: 0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch + BuildRequires: make BuildRequires: gcc BuildRequires: gnupg2 @@ -677,6 +685,12 @@ fi %changelog +* Thu Jul 30 2026 Luboš Uhliarik - 2:1.26.3-6.6 +- Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory + modification or denial of service (CVE-2026-56434) +- Resolves: RHEL-217956 - nginx: NGINX: Memory disclosure and denial of service + in ngx_http_slice_module (CVE-2026-60005) + * Fri Jul 03 2026 Luboš Uhliarik - 2:1.26.3-6.5 - Resolves: RHEL-191778 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes