Skip to content

Commit 26d863a

Browse files
CBL-Mariner-Botazurelinux-securityjslobodzian
authored
[AUTO-CHERRYPICK] [AutoPR- Security] Patch telegraf for CVE-2026-27571 [HIGH] - branch main (#16036)
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent 9ebde45 commit 26d863a

File tree

2 files changed

+109
-8
lines changed

2 files changed

+109
-8
lines changed
Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
From f5b9b962927afe19af3266201b1ebdf12611af11 Mon Sep 17 00:00:00 2001
2+
From: Ivan Kozlovic <ivan@synadia.com>
3+
Date: Mon, 8 Dec 2025 10:25:20 -0700
4+
Subject: [PATCH] Websocket: limit buffer size during decompression of a frame
5+
6+
When the server would decompress a compressed websocket frame, it would
7+
not limit the resulting size of the uncompressed buffer. Once uncompressed
8+
the maximum payload size would still be used to reject messages that
9+
are too big, but the server would have already uncompressed a possibly
10+
very big buffer (if the frame contained highly compressed data).
11+
12+
This PR limits the number of bytes that are being decompressed using
13+
the maximum payload size as a limit.
14+
15+
Credit goes to:
16+
Pavel Kohout, Aisle Research (www.aisle.com) for reporting the issue
17+
and providing a path.
18+
19+
The propose patched as been updated a bit (need to use atomic to
20+
use the connection's max payload value) and some tweaks around
21+
the use of the `io.LimitedReader`.
22+
23+
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
24+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
25+
Upstream-reference: https://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017.patch
26+
---
27+
.../nats-server/v2/server/websocket.go | 26 ++++++++++++++++---
28+
1 file changed, 22 insertions(+), 4 deletions(-)
29+
30+
diff --git a/vendor/github.com/nats-io/nats-server/v2/server/websocket.go b/vendor/github.com/nats-io/nats-server/v2/server/websocket.go
31+
index e026674d..1804b4de 100644
32+
--- a/vendor/github.com/nats-io/nats-server/v2/server/websocket.go
33+
+++ b/vendor/github.com/nats-io/nats-server/v2/server/websocket.go
34+
@@ -31,6 +31,7 @@ import (
35+
"strconv"
36+
"strings"
37+
"sync"
38+
+ "sync/atomic"
39+
"time"
40+
"unicode/utf8"
41+
42+
@@ -203,6 +204,7 @@ func (c *client) wsRead(r *wsReadInfo, ior io.Reader, buf []byte) ([][]byte, err
43+
err error
44+
pos int
45+
max = len(buf)
46+
+ mpay = int(atomic.LoadInt32(&c.mpay))
47+
)
48+
for pos != max {
49+
if r.fs {
50+
@@ -316,7 +318,7 @@ func (c *client) wsRead(r *wsReadInfo, ior io.Reader, buf []byte) ([][]byte, err
51+
// When we have the final frame and we have read the full payload,
52+
// we can decompress it.
53+
if r.ff && r.rem == 0 {
54+
- b, err = r.decompress()
55+
+ b, err = r.decompress(mpay)
56+
if err != nil {
57+
return bufs, err
58+
}
59+
@@ -390,7 +392,16 @@ func (r *wsReadInfo) ReadByte() (byte, error) {
60+
return b, nil
61+
}
62+
63+
-func (r *wsReadInfo) decompress() ([]byte, error) {
64+
+// decompress decompresses the collected buffers.
65+
+// The size of the decompressed buffer will be limited to the `mpay` value.
66+
+// If, while decompressing, the resulting uncompressed buffer exceeds this
67+
+// limit, the decompression stops and an empty buffer and the ErrMaxPayload
68+
+// error are returned.
69+
+func (r *wsReadInfo) decompress(mpay int) ([]byte, error) {
70+
+ // If not limit is specified, use the default maximum payload size.
71+
+ if mpay <= 0 {
72+
+ mpay = MAX_PAYLOAD_SIZE
73+
+ }
74+
r.coff = 0
75+
// As per https://tools.ietf.org/html/rfc7692#section-7.2.2
76+
// add 0x00, 0x00, 0xff, 0xff and then a final block so that flate reader
77+
@@ -405,8 +416,15 @@ func (r *wsReadInfo) decompress() ([]byte, error) {
78+
} else {
79+
d.(flate.Resetter).Reset(r, nil)
80+
}
81+
- // This will do the decompression.
82+
- b, err := io.ReadAll(d)
83+
+ // Use a LimitedReader to limit the decompressed size.
84+
+ // We use "limit+1" bytes for "N" so we can detect if the limit is exceeded.
85+
+ lr := io.LimitedReader{R: d, N: int64(mpay + 1)}
86+
+ b, err := io.ReadAll(&lr)
87+
+ if err == nil && len(b) > mpay {
88+
+ // Decompressed data exceeds the maximum payload size.
89+
+ b, err = nil, ErrMaxPayload
90+
+ }
91+
+ lr.R = nil
92+
decompressorPool.Put(d)
93+
// Now reset the compressed buffers list.
94+
r.cbufs = nil
95+
--
96+
2.45.4
97+

SPECS/telegraf/telegraf.spec

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: agent for collecting, processing, aggregating, and writing metrics.
22
Name: telegraf
33
Version: 1.29.4
4-
Release: 20%{?dist}
4+
Release: 21%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -28,11 +28,12 @@ Patch14: CVE-2024-51744.patch
2828
Patch15: CVE-2025-30215.patch
2929
Patch16: CVE-2025-22872.patch
3030
Patch17: CVE-2025-10543.patch
31-
Patch18: CVE-2025-47911.patch
32-
Patch19: CVE-2025-58190.patch
33-
Patch20: CVE-2026-2303.patch
34-
Patch21: CVE-2026-26014.patch
35-
Patch22: CVE-2025-11065.patch
31+
Patch18: CVE-2026-27571.patch
32+
Patch19: CVE-2025-47911.patch
33+
Patch20: CVE-2025-58190.patch
34+
Patch21: CVE-2026-2303.patch
35+
Patch22: CVE-2026-26014.patch
36+
Patch23: CVE-2025-11065.patch
3637
BuildRequires: golang
3738
BuildRequires: iana-etc
3839
BuildRequires: systemd-devel
@@ -103,12 +104,15 @@ fi
103104
%dir %{_sysconfdir}/%{name}/telegraf.d
104105

105106
%changelog
106-
* Tue Feb 17 2026 Akhila Guruju <v-guakhila@microsoft.com> - 1.29.4-20
107+
* Tue Feb 17 2026 Akhila Guruju <v-guakhila@microsoft.com> - 1.29.4-21
107108
- Patch CVE-2025-11065
108109

109-
* Mon Feb 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.29.4-19
110+
* Mon Feb 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.29.4-20
110111
- Patch for CVE-2026-26014, CVE-2026-2303, CVE-2025-58190, CVE-2025-47911
111112

113+
* Fri Feb 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.29.4-19
114+
- Patch for CVE-2026-27571
115+
112116
* Mon Dec 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.29.4-18
113117
- Patch for CVE-2025-10543
114118

0 commit comments

Comments
 (0)