Re: git: 14b3a97af857 - main - www/nginx: Update to 1.30.3
- In reply to: Bryan Drewery : "Re: git: 14b3a97af857 - main - www/nginx: Update to 1.30.3"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 19 Jun 2026 07:02:33 UTC
Am 18.06.26 um 22:22 schrieb Bryan Drewery: > On 6/18/26 9:00 AM, Jochen Neumeister wrote: >> The branch main has been updated by joneum: >> >> URL:https://cgit.FreeBSD.org/ports/commit/? >> id=14b3a97af857aa71cbf1b91921e530b34f440c31 >> >> commit 14b3a97af857aa71cbf1b91921e530b34f440c31 >> Author: Jochen Neumeister<joneum@FreeBSD.org> >> AuthorDate: 2026-06-18 15:59:46 +0000 >> Commit: Jochen Neumeister<joneum@FreeBSD.org> >> CommitDate: 2026-06-18 15:59:46 +0000 >> >> www/nginx: Update to 1.30.3 >> Changes with nginx 1.30.3 >> 17 Jun >> 2026 >> *) Security: a heap memory buffer overflow might occur in a >> worker >> process when using a configuration with >> "ignore_invalid_headers >> off;" >> and "large_client_header_buffers" with large configured >> values >> when >> proxying a specially crafted request to HTTP/2 or gRPC >> backend, >> allowing an attacker to cause worker process memory >> corruption or >> segmentation fault in a worker process (CVE-2026-42055). >> Thanks to Mufeed VH of Winfunc Research. >> *) Security: a heap memory buffer overread might occur in a >> worker >> process while handling a specially sent response with >> decoding >> from >> UTF-8 via the "charset_map" directive, allowing an >> attacker to >> cause >> a limited disclosure of worker proccess memory or >> segmentation >> fault >> in a worker process (CVE-2026-48142). >> Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE. >> Sponsored by: Netzkommune GmbH > > Are you planing to bring this into quarterly? > > > Yeah, that's landing today in Q2 2026 :)