CLSA-2026-1791276939
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791276939
- Upstream
- Published
- 2026-10-06T08:55:50Z
- Modified
- 2026-10-26T09:31:53Z
- Summary
- Fix CVE(s): CVE-2026-42533
- Details
-
- SECURITY UPDATE: heap buffer overflow in the script engine when a map
regex capture or a non-cacheable variable changes length between the
length and copy passes of a string expression
- debian/patches/CVE-2026-42533.patch: add buffer end checks to the http and stream script copy codes, the access logs and the direct script users in the proxy, fastcgi, scgi, uwsgi, grpc, index and try_files modules, and cut the result to its actual length
- debian/modules/patches/http-ndk/CVE-2026-42533-ndk.patch: emit the new complex value end code in the bundled NDK, which keeps its own copy of the rewrite value compiler
- debian/modules/patches/nchan/CVE-2026-42533-nchan.patch: bounds check the script copy codes run by the bundled nchan module
- CVE-2026-42533
- IMPORTANT: the layout of the script engine structures changed (an end pointer was added to ngx_http_script_engine_t and ngx_stream_script_engine_t, and a status field to the stream one), and complex values compiled for the rewrite engine now need the new ngx_http_script_complex_value_end_code. Third-party dynamic modules that drive the nginx script engine directly must be rebuilt against this version and updated, otherwise they cause memory corruption and worker crashes. This affects NDK based modules such as set-misc, array-var, encrypted-session, form-input and the set_by_lua directive of the lua module. The bundled NDK has been adapted.
- SECURITY UPDATE: heap buffer overflow in the script engine when a map
regex capture or a non-cacheable variable changes length between the
length and copy passes of a string expression
- References