Hi Jan, On Fri, Sep 04, 2026 at 06:02:35PM +0000, Jan Mojzis wrote: > Package: release.debian.org > Severity: normal > Tags: trixie > X-Debbugs-Cc: [email protected] > Control: affects -1 + src:nginx > User: [email protected] > Usertags: pu > > [ Reason ] > > The update fixes three security vulnerabilities in nginx: > > * CVE-2026-42533: a heap buffer overflow in the nginx script engine. > It can be triggered when a map directive performs regular-expression > matching and a string expression references captures modified by the > map, or when non-cacheable variables change between the script length > and copy passes. > > * CVE-2026-56434: a use-after-free caused by duplicate finalization of > an HTTP subrequest. The issue is observable with SSI, proxy_pass and > proxy_buffering off when an upstream response causes the same > subrequest to be posted twice. > > * CVE-2026-60005: an uninitialized memory read caused by stale regular > expression captures. ngx_http_regex_exec() could replace the > captures array without clearing r->ncaptures when the new regular > expression did not match. A subsequent unnamed capture could then > access uninitialized memory. The issue was introduced upstream by > commit 746fba0d79c6, first released in nginx 1.15.8. > > The update also adds debian/tests/abicheck. This test is intended to > detect unintended changes to the public nginx module ABI. In > particular, it provides a safeguard for future stable updates: when > backporting and applying another patch, the test will detect changes to > the public headers if the package continues to declare the same nginx > ABI. > > [ Impact ] > > Without the update all three CVE-2026-42533 CVE-2026-56434 CVE-2026-60005 > will be unfixed. > > [ Tests ] > > The package was tested using automated pipeline: > - https://salsa.debian.org/janmojzis/nginxtest/-/jobs/10252629 > > And also manuly on AMD64 version Debian trixie. > > [ Risks ] > > The fixes for CVE-2026-56434 and CVE-2026-60005 are small, direct > backports of upstream changes. > > The CVE-2026-42533 fix is larger because upstream added fields to > ngx_http_script_engine_t and ngx_stream_script_engine_t. Applying that > layout change directly to trixie would break binary compatibility with > existing third-party nginx modules: the nginx module signature does not > cover these structures, so affected modules could load successfully and > then corrupt memory. > > The new abicheck test reduces the risk of inadvertently breaking the nginx > module ABI, both in this update and in future stable updates. It verifies > that packages declaring the same nginx ABI continue to ship identical public > headers and detects changes to public structures or declarations that would > otherwise require an ABI transition and rebuild of dependent third-party > modules. > > [ Checklist ] > > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable > > > [ Changes ] > * d/t/abicheck add, detect unintended API changes in the nginx-dev > package by comparing header files with previous version > * d/p/CVE-2026-56434.patch add, backport fix for use-after-free when using > ngx_http_ssi_module (CVE-2026-56434) > * d/p/CVE-2026-60005.patch add, backport fix for memory disclosure > vulnerability when using ngx_http_slice_module (CVE-2026-60005) > * d/p/CVE-2026-42533.patch add, backport fix for buffer overflow > vulnerability when using map with regex (CVE-2026-42533) > A big thanks to Aron Xu for preparing the patch. > > > [ Other info ] > * https://security-tracker.debian.org/tracker/CVE-2026-42533 > * https://security-tracker.debian.org/tracker/CVE-2026-56434 > * https://security-tracker.debian.org/tracker/CVE-2026-60005 > > > A big thanks to Aron Xu for preparing the CVE-2026-42533.patch patch.
Assuming you agreed here with Aron to make it a point release update now as it is just around the corner. In same vein, if you are confident that the debdiff will be acceped as it by SRM, then you can go now ahread with the upload already: this because the window for point release updates will close this very weekend. Aron, I'm updating the entries as no-dsa and dropping so the package then from dsa-needed? Regards, salvatore
