Skip to content

Commit 324fab4

Browse files
CBL-Mariner-Botazurelinux-securityKanishk-Bansaljslobodzian
authored
Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch nginx for CVE-2026-1642 [HIGH] - branch main" #15928
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent 722e30a commit 324fab4

2 files changed

Lines changed: 54 additions & 1 deletion

File tree

SPECS/nginx/CVE-2026-1642.patch

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
From 8a1de7eceb8c836d85868386814abe50c74d6f84 Mon Sep 17 00:00:00 2001
2+
From: Roman Arutyunyan <arut@nginx.com>
3+
Date: Thu, 29 Jan 2026 13:27:32 +0400
4+
Subject: [PATCH] Upstream: detect premature plain text response from SSL
5+
backend.
6+
7+
When connecting to a backend, the connection write event is triggered
8+
first in most cases. However if a response arrives quickly enough, both
9+
read and write events can be triggered together within the same event loop
10+
iteration. In this case the read event handler is called first and the
11+
write event handler is called after it.
12+
13+
SSL initialization for backend connections happens only in the write event
14+
handler since SSL handshake starts with sending Client Hello. Previously,
15+
if a backend sent a quick plain text response, it could be parsed by the
16+
read event handler prior to starting SSL handshake on the connection.
17+
The change adds protection against parsing such responses on SSL-enabled
18+
connections.
19+
20+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
21+
Upstream-reference: https://github.com/nginx/nginx/commit/784fa05025cb8cd0c770f99bc79d2794b9f85b6e.patch
22+
---
23+
src/http/ngx_http_upstream.c | 9 +++++++++
24+
1 file changed, 9 insertions(+)
25+
26+
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
27+
index ded833c..a567226 100644
28+
--- a/src/http/ngx_http_upstream.c
29+
+++ b/src/http/ngx_http_upstream.c
30+
@@ -2443,6 +2443,15 @@ ngx_http_upstream_process_header(ngx_http_request_t *r, ngx_http_upstream_t *u)
31+
return;
32+
}
33+
34+
+#if (NGX_HTTP_SSL)
35+
+ if (u->ssl && c->ssl == NULL) {
36+
+ ngx_log_error(NGX_LOG_ERR, c->log, 0,
37+
+ "upstream prematurely sent response");
38+
+ ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR);
39+
+ return;
40+
+ }
41+
+#endif
42+
+
43+
u->state->bytes_received += n;
44+
45+
u->buffer.last += n;
46+
--
47+
2.45.4
48+

SPECS/nginx/nginx.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Name: nginx
77
# Currently on "stable" version of nginx from https://nginx.org/en/download.html.
88
# Note: Stable versions are even (1.20), mainline versions are odd (1.21)
99
Version: 1.22.1
10-
Release: 14%{?dist}
10+
Release: 15%{?dist}
1111
License: BSD-2-Clause
1212
Vendor: Microsoft Corporation
1313
Distribution: Mariner
@@ -21,6 +21,7 @@ Patch0: CVE-2023-44487.patch
2121
Patch1: CVE-2024-7347.patch
2222
Patch2: CVE-2025-23419.patch
2323
Patch3: CVE-2025-53859.patch
24+
Patch4: CVE-2026-1642.patch
2425
BuildRequires: libxml2-devel
2526
BuildRequires: libxslt-devel
2627
BuildRequires: openssl-devel
@@ -148,6 +149,10 @@ exit 0
148149
%{_sysconfdir}/%{name}/modules/otel_ngx_module.so
149150

150151
%changelog
152+
* Tue Feb 10 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.22.1-15
153+
- Patch for CVE-2026-1642
154+
- Enable stream ssl preread module
155+
151156
* Tue Aug 19 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.22.1-14
152157
- Patch for CVE-2025-53859
153158

0 commit comments

Comments
 (0)